I dont't get it. If a user can pre-configure Click to Play on a trusted website to load plugins automatically, what happens if that "legitimate" website gets compromised? Does Click to Play have a way to tell whether a site has been compromised? If not, then what's the point of all this?