Gemini sounds neat. Not sure I'll continue playing with it, but from the spec I have a couple of suggestions you are free to implement or ignore. # Denial of Service Permitting zero or more whitespace characters in a request a introduces a denial of service because the request is no longer bounded. Just keep sending whitespace to keep the connection open. Mandating a single character closes this particular hole. It's…
I like your first suggestion, the rest don’t sound so great to me. It’s simple now, let’s keep it like that.
There are many ways to handle it client-side:
1. Behaviour like iframes, although I don't like the tracking implications.
2. Origin server fetch, as I mentioned.
3. Another possibility is to render it as a button which the client must trigger to load the document.