don't allow-same-origin; use srcdoc if available; make editor read-only until it loads

ideally this would be three commits but whatever