Some HTML files were importing iframe_api.js automatically by detecting the referrer document.
While this was done in a safe way (the map container does not use cookies), it is not
a best practice to load a script originating from document.referrer.
This PR solves the issue by using PHP to inject the correct domain name in the HTML files.
When selected custom menu is removed, go to settings menu
Allow iframe in custom menu to use Scripting API
Return menu object when it is registered, can call remove function on it
