As per one of the TODOs, it is safe to lowercase all hosts because uppercase and lowercase values would be routed to the same place. Not really sure if that helps at all.

I like the UI for that.

Popup doesn't exist anymore, and the extension "browser action" now opens the config page.

I think this is ready, I've tested that it works on GitHub. I don't think there's any security issues with how it prompts for consent on hosts that aren't already approved (right now the background script injects a confirm dialog into the target tab).

I just wanted to say that the work you did for moving the websocket to the background script I already did in #225, but @kylecarbs still hasn't reviewed it. It's like 2 months old now.