Add header to prevent Chrome from freaking out
Apparently header value must be a string
Remove special header; only works if sent from Canvas server
Try to resolve non-unique resource_link_id issue
Try removing editor button
Fix auth bug
Add redirect for regular placement
Add editor button back
Add resource_selection back
Remove auth, just let any key/secret work for now to make it easier for users to configure
Make our own random placement_id as a workaround to Canvas' non-unique resource_link_ids
Fix JS XSS issue (hopefully)
Forgot to commit new file
Clean up JS