Allow cross-domain iframe loading for all origins

Using the xframe_options_exempt decorator didn't seem to work when
using Django's Site model or the url templatetag.
Add id to widget's iframe and fix src URL
Add Ajax view to get image URLs by tag
Process message with tag name received from parent window
Fetch and render the images for the requested tag