Serving private HTML in an iframe

When SolidOS is served on an origin different from the pod it is accessing (for example the SolidOS Webapp or Data-Kitchen, panes that use Iframes for HTML (dokeli, human-readable) will require a second login even if the user is already logged in as owner of the data. The images below show that that dokeli pane won't show the private HTML but the source pane will. The main page login applies to the location of SolidOS, while the iframe origin is that of the imported page.

With the source pane, I believe we can solve this issue by doing an authenticated GET on the HTML, and then displaying it in an iframe using the srcDoc attribute rather than the src attribute. Using srcDoc means that the HTML is coming from the same origin as SolidOS so it should work even when SolidOS is on a different server. I am not sure if this solution would apply to dokeli.

Start by locating the source pane and dokeli iframe implementations mentioned in the issue, then trace how each loads private HTML when SolidOS and the pod use different origins. Verify the result with a private HTML document: both panes should display it without requiring a second login, including when accessed from the SolidOS Webapp or Data-Kitchen.