Hotfix: cross-origin API requests host interception; <iframe> display: none override

This is a hotfix for an older 0.7.0 release
Do not use with a later releases