I believe this was meant to work with purple-url-handler or something to allow
other applications to send messages, but this just seems like a bad idea across
the board, so we're removing it for now. We can always add something back later
if we determine that a use case justifies that security potential.

Ran with the turtles.