Fixes #3409
Merge pull request #3425 from edx/pk-set-can-be-none

pk_set can be None
xblock-external-ui: Add XBlock API call to render XBlock views
xblock-external-ui: Include CSRF token in the API answer
xblock-external-ui: Adds support for CORS headers (cross-domain request)
xblock-external-ui: Include full path when building local_url
xblock-external-ui: Fix TestHandleXBlockCallback & bok_choy, add tests

* Fix tests of TestHandleXBlockCallback
* Fix bok_choy tests
* Add test for xblock_view
xblock-external-ui: Only return `instance` in `_invoke_xblock_handler()`
xblock-external-ui: Group resources by hash tag to avoid duplicate loads