One attempt at making source map URLs cleaner.

You get the source map for /foo.js by asking for /foo.js?sourcemap=y.

Source files then implicitly show up next to them in the tree.
Add anti-XSSI header to source maps in client programs.

This is done at bundle time when constructing the manifest; it does not affect
source maps in unipackages, etc.
Add instructions on enabling source maps to linked browser code.