xblock-external-ui: Add XBlock API call to render XBlock views

@cpennington @nedbat @ormsbee Can you have a quick look to check that I'm on the right path with this? It seem to work well, rendering either individual blocks or verticals containing both XBlocks and XModules. If that's the correct approach, I'll flesh it out more, add tests and start working on the client side, but I could use a sanity check : ) Thanks!
Looks like the latest version of `django-cors-header` is 0.13: https://pypi.python.org/pypi/django-cors-headers Any specific reason for using an out-of-date version?