Sanity checking the URLs to components

- [x] we detect github.com URLs and complain (we need github.io URLs)
- [x] tested to work with localhost:9001 for component-serving purposes
- [x] we convert full user.github.io/repo URLs to the server-proxied version to get around CORS

I wish we had some infrastructure for dialogs rather than alerts, but that can happen later.