better notes for people copying js into another script
data-uri support on profile badge js
don't need course id for all launches anymore, only some
make API call on LTI launch to ensure valid token