jihad-popup: window.open from a tap, and from page load (served over http)