Security Update

I discovered that the previous method 1 was still putting the user id
and api key in plain text that was viewable in the source. This update
uses a session to pass the variables to the iframe so they aren’t
viewable when looking at the source code.