add some uncommitted notes as code review

www/common/common-hash.js

@@ -465,7 +465,7 @@ Version 4: Data URL when not a realtime link yet (new pad or "static" app)
 
         if (!/^https*:\/\//.test(href)) {
             // If it doesn't start with http(s), it should be a relative href
-            if (!/^\//.test(href)) { return ret; }
+            if (!/^\//.test(href)) { return ret; } // XXX this will allow protocol relative URLs
             idx = href.indexOf('/#');
             ret.type = href.slice(1, idx);
             if (idx === -1) { return ret; }

www/common/media-tag.js

@@ -408,7 +408,7 @@ var factory = function () {
             if (err || !u8) { return void fetch(); }
 
             var size = Decrypt.decodePrefix(u8.subarray(0,2));
-            console.error(size);
+            console.error(size); // XXX noise
 
             cb(null, u8.subarray(0, size+2));
         });

www/common/outer/local-store.js

@@ -123,7 +123,7 @@ define([
         cb = cb || function () {};
 
         try {
-            Cache.clear(cb);
+            Cache.clear(cb); // XXX might call back twice in extreme circumstances?
         } catch (e) {
             console.error(e);
             cb();