Test the CORS injection of js file...

test.js

// TEST ability to create your own divs and such
var _myDiv = document.createElement('div');
document.body.appendChild(_myDiv);
_myDiv.style.width = "50px";
_myDiv.style.height = "50px";
_myDiv.style.background = "black";
_myDiv.id = "foobar";
_myDiv.style.position = "fixed";
_myDiv.style.top = 0;

document.body.addEventListener('click', function(e){
    alert(JSON.stringify(e));
});

// TEST ability to modify window global
// grab url params and assign on page load
(function (window, document) {
    var match,
        pl     = /\+/g,  // Regex for replacing addition symbol with a space
        search = /([^&=]+)=?([^&]*)/g,
        decode = function (s) {
            return decodeURIComponent(s.replace(pl, " "));
        },
        query  = window.location.search.substring(1);
 
    window._ourParams = {};
    while (match = search.exec(query))
       window._ourParams[decode(match[1])] = decode(match[2]);
})(this, this.document);