implement a "demo mode" where write-changes to the DB are disabled, but return "ok" to the client
iframe js: add target="_new" to injected js to prevent outgoing links from loading *in* the iframe
reader: restructure the feed bar and fix other layout issues
reader: use jqote escape to prevent injections