Notice that the user agent string gets rewritten to something innocuous in HTTP headers but not JS. So sniff client-side through JS.