allow insecure iframe in development mode
add the token to a hidden field
rename token and pass to view
redirect with token
make variables instance vars so they can be passed to views
add avatar_helper
replace UI with one that more closely matches the canvas roster UI
add the user's avatar_url when fetching group users
return group memberships from add_user and remove_user
add avatar_url accessor
override default styling
add styles
refactor js to be more ajaxy

- replace table contents on add/remove user, instead of reloading the entire page
- make ajax calls actually async
- abort incomplete ajax calls on keyup in search field
- general refactoring and making-bettering
add sweet-alert
allow post_to_api to accept different HTTP methods
add sweet-alert assets to pipeline
include sweet-alert assets
add set_group_leader functionality