Fix #1 - modules are sandboxed.

Adding @FWeinb's solution to use 'about:blank' for synchronous iframe injection.

Also added module caching (and fixed references getting destroyed when iframe was removed - so we leave it in place, see comment in code).

Also adds and fixes the sourceURL support so that the resource appears under the domain in sources panel.