New 'Inception' attack shows why it's still important to display the URL bar on space-constrained mobile devices.