Having thought more about this I think that the best way to tackle the active content problem is to convert the xml to a jsonp file at export time and then we simply include that as we would any other js file... no browser will ever block those and it gets round the problem of mini-webservers being blocked from execution etc...
Ah. Good thinking. It shouldn't be hard to implement that with the new editor. It sends json data to the backend already. We would need to adapt the engine a bit, but that should also be doable.