use thickbox() for tinymce button; harden Wikitude API