Doing this for random web apps is bad enough that you shouldn't do it, period. At the very least your README should be covered in warnings that it's a bad idea.

Doing this for random web apps is bad enough that you shouldn't do it, period. At the very least your README should be covered in warnings that it's a bad idea. Really the only scenario where it is sort-of maybe acceptable if is a homeserver hosts additional software for its users (and then it shouldn't allow any other homeserver to be entered).