Update the code for the tutorial

- Sync the tutorial with the latest Conductor/Oasis/RSVP.
- Add support for `allow-same-origin` on a sandboxed iframe (needed for the youtube card).
- Disable `autoupdate` on the `HeightService` (it doesn't work, it needs to be fixed)