xblock-external-ui: Add XBlock API call to render XBlock views
xblock-external-ui: Include CSRF token in the API answer
xblock-external-ui: Adds support for CORS headers (cross-domain request)
xblock-external-ui: Include full path when building local_url
xblock-external-ui: Fix TestHandleXBlockCallback & bok_choy, add tests

* Fix tests of TestHandleXBlockCallback
* Fix bok_choy tests
* Add test for xblock_view
xblock-external-ui: Only return `instance` in `_invoke_xblock_handler()`
xblock-external-ui: Group resources by hash tag to avoid duplicate loads
xblock-external-ui: Alternate referer check for CORS requests