Exactly. And if the same machine used two URIs, there'd simply be two entries for settings. And the settings cache could flush old entries periodically.

Like two websites that look the same, except one captures your creds?

You don't want user prefs to apply to multiple locations solely based on URI.

Just because two URIs might appear to be similar doesn't mean they are identical. Using the URI string as a hash key wouldn't be vulnerable to this.