Against privacy defeatism: why browsers can still stop fingerprinting