Visualizer responds to js and text requsts too.
Skips xss forgery protects, because we want to allow xss here.