Move vomnibar to iframe (follow on to #1139)

This is #1139 from @mrmr1993 rebased onto master (with a couple of bug fixes and test improvements).

@mrmr1993: Could you cast your eye over it and verify that I picked up on all of your work, and didn't break anything.

I'm minded to merge this. @philc expressed his approval over in #1139, and @mrmr1993 has addressed the issues @philc raised.  And it works nicely, there's no lagginess.  And we need this in `master` if we're going to make use of it in fixing a number of other issues.
Since you added the escaping (good catch, by the way!), this line is now redundant.