probably will need a manifest, and to stop fingerprinting (requires .json file which can't be loaded from CORS)