Critical privacy/data integrity fix: Move cross-domain capable message listener into own extension (ext-xdomain-messaging.js) and do not include by default (the extension now won't work anyways without an allowedOrigins config first being set (in config.js) for security reasons (and not via URL)); add allowedOrigins config and demo use in config-sample.js; JSLint; update embedapi.html to supply the xdomain extension in case running xdomain (again, allowedOrigins must be supplied in the local copy of config.js for this to work); modify embedapi.js to allow reuse of cross-domain API with same-domain usage, but without the intermediate JSON parsing which could lose some non-JSONable arguments or response.

git-svn-id: http://svg-edit.googlecode.com/svn/trunk@2714 eee81c28-f429-11dd-99c0-75d572ba1ddd
Allow embeddedapi.html to pass on its URL arguments to the iframe

git-svn-id: http://svg-edit.googlecode.com/svn/trunk@2719 eee81c28-f429-11dd-99c0-75d572ba1ddd
Ensure top URL will change in case it wishes to react according to storagePrompt param (such as in the embedded editor).

git-svn-id: http://svg-edit.googlecode.com/svn/trunk@2722 eee81c28-f429-11dd-99c0-75d572ba1ddd