If they've got to rely on the infrastructure provider to know what I've been looking at, then I assume that they don't have infrastructure in place themselves to arbitrarily do HTTP injection in a push button manner. May be wrong though.