Changing my mind on the security header; we want to enable javascript access, and really, read only doesn't need to be protected and the current token system won't prevent against DOS attacks (Which is probably best done at the infrastructure level anyway).

I'll think of something else should this be a problem...
Fixing ID
Correcting minutes, d'oh!
Correcting home URL
Moving CSS to a common directory
First draft Javascript client