There needs to be an API in the client for specifying how much CPU can be used. Clearly things like crypto mining in the bg are considered abuse but what about just poorly written js? Clients should be able to police the code they execute.