api.js: properly remove the XHR object from the pool upon failures

Previously, a failure would not have caused a decrement of the pool length
add a polyfill for the srcdoc attribute and make iframe injection work in FF, IE10 and Chrome
add a somehow-lost screenshot for the first-steps
relay all keydown events from iframes