Ugly: use non-standard instance urls to avoid same-origin-issue (fixes #621)

This makes the instance badge overlay use an iframe with the same url as
the outer instance list. This is possible as `/instance/xxx/member` urls
also work.

The proper solution would propably be to use CORS, but this isn't
trivial.

This fixes #621.