Have better story for getting correct JavaScript code

[davidben]

Unfortunately we rely on the server to send us the correct JS code. We also rely on the CA system to work for SSL. Investigate ways to lessen this trust. It's possible a browser extension is the best answer here.