This sends requests by one of 3 external proxies: https://github.com/niutech/x-frame-bypass/blob/855835ec48f92bfc825a88284b17218cb1867f7f/x-frame-bypass.js#L68-L70

This means it won't work on a VPN, isn't suitable for any situation where the other origin is returning sensitive or protected data, and allows hacks from any of those proxy sites should any of them choose to inject JS into the conte

Right now it's unintuitive that certain things on the page don't work when you click them, it's hard to put 2 and 2 together that 'oh it's because I'm in edit mode with Simpla'. The pointer events disabler should either a) also toggle the cursor to not-allowed, or b) toggle opacity. Opacity would be much harder because it's a cumulative effect for each tree, and it can seriously mess with site d

It might be useful to add metadata to each key indicating the note and octave the key represents. E.g. this could be used in a click event listener to create a note sequence from user input.