Comment by nfm

From the quoted snippet, every page load is leaking both the domain and authed user’s ID to Firebase.