Allowing config flag to turn off javascript controls

[mistercrunch]

[betodealmeida]

Looks good, one question only: have you considered completely removing the form in this case, instead of having the warning? Can we also disable the Javascript form in this case, so it's read only?

[betodealmeida]

Nit: you can do this in a single line

d = {k: v for k, v in d.items() if k not in FORM_DATA_KEY_BLACKLIST}

[mistercrunch]

extra points for avoiding the mutation

[mistercrunch]

Since the default is to set the feature off (secure should be the default), I want for the users to see that the feature exists otherwise there's no way for the users to discover that the feature exists.

I looked quickly at the react-ace to see if a disabled prop exists but apparently not, so decided to just have the warning icon instead:
https://github.com/securingsincity/react-ace/blob/master/src/ace.js

[mistercrunch]

Oh looks like there's a readOnly prop I missed on my first pass

[mistercrunch]

@betodealmeida made the fields readOnly

[mistercrunch]

For the record a security expert mentioned in an email:

If you create an iframe in the `none` origin, you could then use the postMessage API to
send it the function definition (as a string) along with the data. It could then eval the function
definition, run it on the data, and then use the postMessage API to send the mutated data
back to the app to be rendered. 

[mistercrunch]

Addressed comments, merging.