Outline a solution to the badge user privacy issue

This is a spike that came out of this [earlier spike about the badge](https://github.com/hypothesis/product-backlog/issues/953).

**Problem:** The Chrome extension's badge feature sends every URL the user visits to our server and, even though we don't keep this browser history or do anything with it, we think that the fact that it is being sent to us at all is a problem.

Also we think there may be a simple solution to this problem. Something along the lines of that the client can just hash the URL first.

**The task for this spike** is to outline a solution to this problem (and this problem only!) and type it up on this card.