On a similar topic, I seem to have broken something by putting a javascript:alert in the embed field:

http://sitekite.com/test-V2IjEA

And setting user cookies to HTTP only.