What are the http headers here? Should we include information about the app? What referrer policy should be used? @LuHuangMSFT