Why not just ensure that it's the same origin as the core viewer?

In some browsers, you can use `window.location.origin`. In others, you can use a simple polyfill:
http://stackoverflow.com/questions/1420881/javascript-jquery-method-to-find-base-url-from-a-string

I'm mainly mentioning this since we've hardcoded stuff like this in the past, and it has bitten us! :frowning: