switch to a completely client-side version

doesn't quite work because of same-origin policy,
but might work if hosted on the hotcrp origin.