Bug fixes from Jive

Three bug fixes:
Editor.hidden wasn't initialized correctly when the swallowed textarea was display:none, resulting in incorrect behavior when we called Editor.show later (nothing happened, the editor remained hidden).

Implementing the XSS protection that CSP offers requires that we not have inline scripts or event handlers.  Fixed the iframe init to work without inline event handlers.

Autoresize takes body margin into account, but it neglected border and padding, which results in a spurious scrollbar (with custom styles).