Our window decides a link is ours with a string prefix, and the string that beats it has an @ in it

An Electron app whose UI is served over HTTP on localhost has to tell its own pages from everyone else's. Ours does it with startsWith on an origin, which is both too loose and too tight, and the fix is six lines.