How bot detection misfires on non-mainstream browsers and privacy tools