I know what you mean but if a web page just has to to request "run me as an app" to get unsandboxed access then you know every popup from every shady site is go

I know what you mean but if a web page just has to to request "run me as an app" to get unsandboxed access then you know every popup from every shady site is going to have a go. It will kill the feature as dead as ActiveX plugins. I want to have the cake and eat it.