The Spotify desktop client is running a server and the play button acts as a remote. It's using regular get requests and seems to require a CORS-compatible browser. It's the same as typing a Spotify URI in your address bar. I think that means non premium users will have ads.