Included commits: * xblock-external-ui: Include CSRF token in the API answer * xblock-external-ui: Adds support for CORS headers (cross-domain request) * xblock-external-ui: Include full path when building local_url
