Good point, thanks for the added detail. Note that one still must fully trust the root resource (the HTML response that bootstraps the web app). Whatever gener

Good point, thanks for the added detail. Note that one still must fully trust the root resource (the HTML response that bootstraps the web app). Whatever generates or stores that response up until it is wrapped in TLS is just as vulnerable.