Add /embed.js view

This is cleaner than disambiguating based on path_info.
Make sure to convert urls to str type in embed

Without this, the list items may be unicode strings and the __repr__
will not be parseable as a valid JS literal.
Refactor the extension build
Be careful not to mix up XSRF-TOKEN cookies

Here's hoping that this solves the intermittent test failures.