Canvas pixel readback is a common fingerprinting vector, isn't it blocked behind a permission popup?