Restore support for launching executables from the about page

with extra care against the obvious security risk of letting any webpage
use an exec URL.