Changes

** We are assuming all pages will open in a new tab. We should document this decision somewhere (e.g. in the code)

** We should document that we are not allowing open web apps to let personas bleed through due to security concerns.