- npm: Add script for testing embedded API

- Fix (Embedded editor): Ensure adding allowedOrigins for embedded response
- Enhancement (Embedded editor): Log if an origin is not whitelisted as sender/receiver
- Demo: Point to raw.githack for proper content-type setting and apparent CORS support; also add `xdomain-svg-editor-es.html` to set origin config and work on Git-based server

editor/extensions/ext-xdomain-messaging.js

@@ -18,10 +18,12 @@ export default {
         if (!data || typeof data !== 'object' || data.namespace !== 'svgCanvas') {
           return;
         }
-        // The default is not to allow any origins, including even the same domain or if run on a file:// URL
-        //  See svgedit-config-es.js for an example of how to configure
+        // The default is not to allow any origins, including even the same domain or
+        //  if run on a file:// URL See svgedit-config-es.js for an example of how
+        //  to configure
         const {allowedOrigins} = svgEditor.curConfig;
         if (!allowedOrigins.includes('*') && !allowedOrigins.includes(e.origin)) {
+          console.log(`Origin ${e.origin} not whitelisted for posting to ${window.origin}`);
           return;
         }
         const cbid = data.id;