The Extension (developed by the same people who build the Rust+ Web app, does nothing more than facilitate the API callback to login to the Facepunch API. The reason for this bridge is because the only whitelisted domain is "localhost" (which would normally be the mobile device). The extension makes it possible for the web app to impersonate localhost for a smooth single sign-on experience to the Rust+ Web app.
