On iOS, opening an InAppBrowser with location=no hides the location field, but leaves the close/back/forward buttons visible (as I would expect from the documentation).
On Android, this same setting hides both the location field and the close/back/forward buttons. This is inconsistent. There seems to be no way to hide just the location field on all platforms, if you don't want users to see the URL.
Suggestion: make these separate config settings; location=no hides just the location field, and something like navigation=no hides the close/back/forward buttons.