Prevent XSS to main jsbin window by running all live rendering inside of run.jsbin.com (also supports local installs). Also exposes a feature to allow embeddable runner *only* allowing users to create their own UI to inject code.