updated athena lib (CORS)
player: isNew forces editable
player: setting editable propagates to view
model: better sync test (auth constraint)

Old test had two problems:
* relied on an existing acorn
* authentication/ownership is now an issue