Set default embed type to release

one URL is still not enabled by default, stay on release
Check for source in our JS messages

The prevents a bug where a random postMessage can trigger our uploader