Now you can't iframe jsbin.com

Note that zero comments allowed as we use them to kill jsbin in iframe mode

@allouis can you test in both jsbin and jsbin embeds to ensure this works.

Note that I've killed the "save" functionality. I'm not happy with it, because if you make changes in embed, it doesn't save anymore, but it's a way of preventing the csrf from leaking upwards... that said, with a few experiments, you might be able to get the crst token out... Don't spend more than 90 minutes on this though!
Would like to fix how this works, but disabled save for now due to csrf being exposed.