Code Injection PR 3489 rebased and updated

This is the code injection PR, rebased on master and updated with the latest and greatest.

Works for admins & owners if `codeInjectionUI: true` is set in config.js