[open-ils-commits] [GIT] Evergreen ILS branch master updated. f6f6c9d73073cdc7282c2e9f5aaf830f0309f89c

Evergreen Git git at git.evergreen-ils.org
Mon Jul 30 10:56:50 EDT 2012


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Evergreen ILS".

The branch, master has been updated
       via  f6f6c9d73073cdc7282c2e9f5aaf830f0309f89c (commit)
       via  27bcb6740e92198523c80d5eef3f63eb8804ad7e (commit)
       via  194a33b381bd5d719deb0988de1858daa2794a6c (commit)
       via  abade21a678eb3ca1ec2e6c423b4c67aa8695a0f (commit)
       via  c45d702d26a423f8136c52e8659ae5d229a99220 (commit)
       via  d320a7e659dfbf7768e8191d0edeb6bf0f9c1dcc (commit)
       via  aa19b9626845b940e189839ebc1210193dd5244d (commit)
       via  ee8fcf051ca41be9cdf0dec5329b6f616f205992 (commit)
       via  adee850f88dcedfd65a19d41a7fb4948d4c7eee3 (commit)
      from  0202761608cc6e3ea512e7171b9bcad8af8bc8ff (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f6f6c9d73073cdc7282c2e9f5aaf830f0309f89c
Author: Thomas Berezansky <tsbere at mvlc.org>
Date:   Sat Jul 28 15:17:40 2012 -0400

    Window.open fixes
    
    Add a window.open compatible "browser" file for unsecured calls.
    
    Add "chrome" to most window.open calls to bypass the wrapper.
    
    Signed-off-by: Thomas Berezansky <tsbere at mvlc.org>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/web/js/dojo/openils/Util.js b/Open-ILS/web/js/dojo/openils/Util.js
index 5745fad..804d13c 100644
--- a/Open-ILS/web/js/dojo/openils/Util.js
+++ b/Open-ILS/web/js/dojo/openils/Util.js
@@ -474,7 +474,7 @@ if(!dojo._hasResource["openils.Util"]) {
      */
     openils.Util.printHtmlString = function(html, callback) {
 
-        var win = window.open('', 'Print Window', 'resizable,width=800,height=600,scrollbars=1'); 
+        var win = window.open('', 'Print Window', 'resizable,width=800,height=600,scrollbars=1,chrome'); 
 
         // force the new window to the background
         win.blur(); 
diff --git a/Open-ILS/web/js/ui/default/acq/common/li_table.js b/Open-ILS/web/js/ui/default/acq/common/li_table.js
index f9abb71..aba6da9 100644
--- a/Open-ILS/web/js/ui/default/acq/common/li_table.js
+++ b/Open-ILS/web/js/ui/default/acq/common/li_table.js
@@ -2662,9 +2662,9 @@ function AcqLiTable() {
             to true in about:config */
 
         if(openils.XUL.isXUL()) {
-            win = window.open('/xul/' + openils.XUL.buildId() + '/server/cat/marcedit.xul');
+            win = window.open('/xul/' + openils.XUL.buildId() + '/server/cat/marcedit.xul','','chrome');
         } else {
-            win = window.open('/xul/server/cat/marcedit.xul'); 
+            win = window.open('/xul/server/cat/marcedit.xul','','chrome'); 
         }
         var self = this;
         win.xulG = {
@@ -2852,7 +2852,7 @@ function AcqLiTable() {
 
         win = window.open(
             oilsBasePath + '/acq/lineitem/findbib?query=' + escape(query),
-            '', 'resizable,scrollbars=1');
+            '', 'resizable,scrollbars=1,chrome');
 
         win.window.recordFound = function(bibId) { 
             win.close();
diff --git a/Open-ILS/web/js/ui/default/acq/financial/claim_voucher.js b/Open-ILS/web/js/ui/default/acq/financial/claim_voucher.js
index c6191f8..70ed2f0 100644
--- a/Open-ILS/web/js/ui/default/acq/financial/claim_voucher.js
+++ b/Open-ILS/web/js/ui/default/acq/financial/claim_voucher.js
@@ -1,6 +1,6 @@
 function openClaimVoucherWindow() {
     var win = window.open(
-        "", "", "resizable,width=800,height=600,scrollbars=1"
+        "", "", "resizable,width=800,height=600,scrollbars=1,chrome"
     );
     /* XXX i18n - also, the reason this isn't loaded from a server-side page
      * has to do with problems of knowing when the page has loaded, so we
diff --git a/Open-ILS/web/js/ui/default/booking/populator.js b/Open-ILS/web/js/ui/default/booking/populator.js
index 1eeb7cb..c6927e6 100644
--- a/Open-ILS/web/js/ui/default/booking/populator.js
+++ b/Open-ILS/web/js/ui/default/booking/populator.js
@@ -333,7 +333,7 @@ function display_transit_slip(e) {
     /* XXX i18n and/or template */
     try {
         var win = window.open(
-            "","","resizeable,width=600,height=400,scrollbars=1"
+            "","","resizeable,width=600,height=400,scrollbars=1,chrome"
         );
         win.document.body.innerHTML =
             "<h1>Transit Slip</h1>\n" +
diff --git a/Open-ILS/web/js/ui/default/cat/authority/list.js b/Open-ILS/web/js/ui/default/cat/authority/list.js
index 99fba63..3f1c666 100644
--- a/Open-ILS/web/js/ui/default/cat/authority/list.js
+++ b/Open-ILS/web/js/ui/default/cat/authority/list.js
@@ -281,7 +281,7 @@ function loadMarcEditor(pcrud, rec) {
        To run in Firefox directly, must set signed.applets.codebase_principal_support
        to true in about:config
      */
-    win = window.open('/xul/server/cat/marcedit.xul'); // XXX version?
+    win = window.open('/xul/server/cat/marcedit.xul','','chrome'); // XXX version?
 
     win.xulG = {
         "record": {"marc": rec.marc(), "rtype": "are"},
diff --git a/Open-ILS/web/js/ui/default/circ/selfcheck/selfcheck.js b/Open-ILS/web/js/ui/default/circ/selfcheck/selfcheck.js
index 886c8c3..0b47be3 100644
--- a/Open-ILS/web/js/ui/default/circ/selfcheck/selfcheck.js
+++ b/Open-ILS/web/js/ui/default/circ/selfcheck/selfcheck.js
@@ -1279,7 +1279,7 @@ SelfCheckManager.prototype.printSessionReceipt = function(callback) {
 
 SelfCheckManager.prototype.printData = function(data, numItems, callback) {
 
-    var win = window.open('', '', 'resizable,width=700,height=500,scrollbars=1'); 
+    var win = window.open('', '', 'resizable,width=700,height=500,scrollbars=1,chrome'); 
     win.document.body.innerHTML = data;
     win.print();
 
diff --git a/Open-ILS/web/js/ui/default/vandelay/vandelay.js b/Open-ILS/web/js/ui/default/vandelay/vandelay.js
index e8b8f5a..8e5f314 100644
--- a/Open-ILS/web/js/ui/default/vandelay/vandelay.js
+++ b/Open-ILS/web/js/ui/default/vandelay/vandelay.js
@@ -1520,7 +1520,7 @@ function vlOpenMarcEditWindow(rec, postReloadHTMLHandler) {
         To run in Firefox directly, must set signed.applets.codebase_principal_support
         to true in about:config
     */
-    win = window.open('/xul/server/cat/marcedit.xul'); // XXX version?
+    win = window.open('/xul/server/cat/marcedit.xul','','chrome'); // XXX version?
 
     var type;
     if (currentType == 'bib') {
diff --git a/Open-ILS/web/opac/common/js/utils.js b/Open-ILS/web/opac/common/js/utils.js
index 444d9cf..3d1366e 100644
--- a/Open-ILS/web/opac/common/js/utils.js
+++ b/Open-ILS/web/opac/common/js/utils.js
@@ -564,7 +564,7 @@ function openWindow( data ) {
 			'chrome,resizable,width=700,height=500'); 
 
 	} else {
-		win = window.open('','', 'resizable,width=700,height=500,scrollbars=1'); 
+		win = window.open('','', 'resizable,width=700,height=500,scrollbars=1,chrome'); 
 		win.document.body.innerHTML = data;
 	}
 }
diff --git a/Open-ILS/web/opac/skin/default/js/rdetail.js b/Open-ILS/web/opac/skin/default/js/rdetail.js
index 2a228f5..3446574 100644
--- a/Open-ILS/web/opac/skin/default/js/rdetail.js
+++ b/Open-ILS/web/opac/skin/default/js/rdetail.js
@@ -337,7 +337,7 @@ function OpenMarcEditWindow(pcrud, rec) {
 	   To run in Firefox directly, must set signed.applets.codebase_principal_support
 	   to true in about:config
 	 */
-	win = window.open('/xul/server/cat/marcedit.xul'); // XXX version?
+	win = window.open('/xul/server/cat/marcedit.xul','','chrome'); // XXX version?
 	dojo.require('openils.PermaCrud');
 
 	win.xulG = {
diff --git a/Open-ILS/web/reports/oils_rpt_utils.js b/Open-ILS/web/reports/oils_rpt_utils.js
index 2ab687e..676d4c7 100644
--- a/Open-ILS/web/reports/oils_rpt_utils.js
+++ b/Open-ILS/web/reports/oils_rpt_utils.js
@@ -129,7 +129,7 @@ function oilsRptDebug() {
 
 	/*
 	if(!oilsRptDebugWindow)
-		oilsRptDebugWindow = window.open('','Debug','resizable,width=700,height=500,scrollbars=1'); 
+		oilsRptDebugWindow = window.open('','Debug','resizable,width=700,height=500,scrollbars=1,chrome'); 
 	oilsRptDebugWindow.document.body.innerHTML = oilsRpt.toHTMLString();
 	*/
 }
diff --git a/Open-ILS/xul/staff_client/chrome/content/cat/opac.js b/Open-ILS/xul/staff_client/chrome/content/cat/opac.js
index 9f58b81..9151ab1 100644
--- a/Open-ILS/xul/staff_client/chrome/content/cat/opac.js
+++ b/Open-ILS/xul/staff_client/chrome/content/cat/opac.js
@@ -736,7 +736,7 @@ function open_mfhd_editor(sre_id) {
 }
 
 function open_marc_editor(rec, label) {
-    win = window.open( xulG.url_prefix('XUL_MARC_EDIT') );
+    win = window.open( xulG.url_prefix('XUL_MARC_EDIT'), '', 'chrome' );
 
     win.xulG = {
         record : {marc : rec.marc()},
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/print.js b/Open-ILS/xul/staff_client/chrome/content/util/print.js
index c3ff12b..c84833a 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/print.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/print.js
@@ -510,9 +510,9 @@ util.print.prototype = {
                             }
                         } else {
                             if (params.content_type == 'text/plain') {
-                                w = window.open('data:text/plain,'+escape(params.msg));
+                                w = window.open('data:text/plain,'+escape(params.msg),'','chrome');
                             } else {
-                                w = window.open('data:text/html,'+escape(params.msg));
+                                w = window.open('data:text/html,'+escape(params.msg),'','chrome');
                             }
                             setTimeout(
                                 function() {
@@ -535,9 +535,9 @@ util.print.prototype = {
                             obj._NSPrint_webBrowserPrint(w,silent,params);
                         } else {
                             if (params.content_type == 'text/plain') {
-                                w = window.open('data:text/plain,'+escape(params.msg));
+                                w = window.open('data:text/plain,'+escape(params.msg),'','chrome');
                             } else {
-                                w = window.open('data:text/html,'+escape(params.msg));
+                                w = window.open('data:text/html,'+escape(params.msg),'','chrome');
                             }
                             setTimeout(
                                 function() {
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/untrusted_window.xul b/Open-ILS/xul/staff_client/chrome/content/util/untrusted_window.xul
new file mode 100644
index 0000000..a68e666
--- /dev/null
+++ b/Open-ILS/xul/staff_client/chrome/content/util/untrusted_window.xul
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<!-- Application: Evergreen Staff Client -->
+<!-- Screen: Window.Open compatible simple browser wrapper for untrusted pages -->
+
+<!-- ///////////////////////////////////////////////////////////////////////////////////////////////////////////// -->
+<!-- STYLESHEETS -->
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window id="util_window_open_browser_win" 
+    xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+    <browser id="browser_browser" flex="1" autoscroll="false" type="content-primary" oils_force_external="true" />
+
+</window>
+
diff --git a/Open-ILS/xul/staff_client/defaults/preferences/standalone_xul_app.js b/Open-ILS/xul/staff_client/defaults/preferences/standalone_xul_app.js
index 2b2fe74..65d995a 100644
--- a/Open-ILS/xul/staff_client/defaults/preferences/standalone_xul_app.js
+++ b/Open-ILS/xul/staff_client/defaults/preferences/standalone_xul_app.js
@@ -9,8 +9,8 @@ pref("javascript.options.jit.content", true);
 pref("general.useragent.locale", "en-US");
 
 // We need something like this to get window.open to work in some places (where it complains about
-// navigator.xul not being registered.  But is about:blank the best value to use here?
-pref("browser.chromeURL","about:blank");
+// navigator.xul not being registered). The untrusted_window file provided the minimum required elements.
+pref("browser.chromeURL","chrome://open_ils_staff_client/content/util/untrusted_window.xul");
 
 // This one just makes things speedier.  We use a lot of XMLHttpRequest
 pref("network.http.max-persistent-connections-per-server",8);
diff --git a/Open-ILS/xul/staff_client/server/cat/marcedit.js b/Open-ILS/xul/staff_client/server/cat/marcedit.js
index 620923a..71e6f22 100644
--- a/Open-ILS/xul/staff_client/server/cat/marcedit.js
+++ b/Open-ILS/xul/staff_client/server/cat/marcedit.js
@@ -2048,7 +2048,7 @@ function loadMarcEditor(pcrud, marcxml, target, sf) {
        To run in Firefox directly, must set signed.applets.codebase_principal_support
        to true in about:config
      */
-    win = window.open('/xul/server/cat/marcedit.xul'); // XXX version?
+    win = window.open('/xul/server/cat/marcedit.xul', '_blank', 'chrome'); // XXX version?
 
     // Match marc2are.pl last_xact_id format, roughly
     var now = new Date;

commit 27bcb6740e92198523c80d5eef3f63eb8804ad7e
Author: Thomas Berezansky <tsbere at mvlc.org>
Date:   Fri Jul 27 16:00:27 2012 -0400

    Change popups to menupopups in marc edit
    
    Because popups are transparent by default.
    
    Signed-off-by: Thomas Berezansky <tsbere at mvlc.org>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/xul/staff_client/server/cat/marcedit.js b/Open-ILS/xul/staff_client/server/cat/marcedit.js
index 5c73636..620923a 100644
--- a/Open-ILS/xul/staff_client/server/cat/marcedit.js
+++ b/Open-ILS/xul/staff_client/server/cat/marcedit.js
@@ -267,7 +267,7 @@ function my_init() {
         context_menus = createComplexXULElement('popupset');
         document.documentElement.appendChild( context_menus );
 
-        tag_menu = createPopup({position : 'after_start', id : 'tags_popup'});
+        tag_menu = createMenuPopup({position : 'after_start', id : 'tags_popup'});
         context_menus.appendChild( tag_menu );
 
         tag_menu.appendChild(
@@ -1114,13 +1114,13 @@ function genToolTips () {
             )
         );
     
-        var i1_popup = createPopup({position : 'after_start', id : 't' + f. at tag + 'i1' });
+        var i1_popup = createMenuPopup({position : 'after_start', id : 't' + f. at tag + 'i1' });
         context_menus.appendChild( i1_popup );
     
-        var i2_popup = createPopup({position : 'after_start', id : 't' + f. at tag + 'i2' });
+        var i2_popup = createMenuPopup({position : 'after_start', id : 't' + f. at tag + 'i2' });
         context_menus.appendChild( i2_popup );
     
-        var sf_popup = createPopup({position : 'after_start', id : 't' + f. at tag + 'sf' });
+        var sf_popup = createMenuPopup({position : 'after_start', id : 't' + f. at tag + 'sf' });
         context_menus.appendChild( sf_popup );
     
         tooltip_hash['tag' + f. at tag] = f.description;
@@ -1495,7 +1495,7 @@ function getAuthorityContextMenu (target, sf) {
         auth_pages[menu_id] = 0;
     }
 
-    var sf_popup = createPopup({ id : menu_id, flex : 1 });
+    var sf_popup = createMenuPopup({ id : menu_id, flex : 1 });
 
     sf_popup.addEventListener("popuphiding", function(event) {
         if (show_auth_menu) {

commit 194a33b381bd5d719deb0988de1858daa2794a6c
Author: Thomas Berezansky <tsbere at mvlc.org>
Date:   Fri Jul 27 12:22:00 2012 -0400

    Fix over-zealous constant change
    
    Signed-off-by: Thomas Berezansky <tsbere at mvlc.org>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/xul/staff_client/chrome/content/main/constants.js b/Open-ILS/xul/staff_client/chrome/content/main/constants.js
index 866700e..d8f795e 100644
--- a/Open-ILS/xul/staff_client/chrome/content/main/constants.js
+++ b/Open-ILS/xul/staff_client/chrome/content/main/constants.js
@@ -398,7 +398,7 @@ var urls = {
     'AUDIO_circ_bad' : '/xul/server/skin/media/audio/question.wav',
     'AUDIO_event_ASSET_COPY_NOT_FOUND' : '/xul/server/skin/media/audio/redalert.wav',
 
-    'AUTHORITY_MANAGE' : 'oils://remote/eg/cat/authority/list',
+    'AUTHORITY_MANAGE' : 'cat/authority/list',
     'MANAGE_MULTI_HOME_ITEMS' : 'oils://remote/xul/server/cat/manage_multi_home_items.xul',
     'XUL_AUTH_SIMPLE' : 'oils://remote/xul/server/main/simple_auth.xul',
     'XUL_BIB_BRIEF' : 'oils://remote/xul/server/cat/bib_brief.xul',

commit abade21a678eb3ca1ec2e6c423b4c67aa8695a0f
Author: Thomas Berezansky <tsbere at mvlc.org>
Date:   Thu Jul 26 16:52:55 2012 -0400

    Another missing height for the pattern wizard
    
    Missed this one on the previous pass.
    
    Signed-off-by: Thomas Berezansky <tsbere at mvlc.org>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/web/js/ui/default/serial/subscription/caption_and_pattern.js b/Open-ILS/web/js/ui/default/serial/subscription/caption_and_pattern.js
index a17c75f..9ccfe64 100644
--- a/Open-ILS/web/js/ui/default/serial/subscription/caption_and_pattern.js
+++ b/Open-ILS/web/js/ui/default/serial/subscription/caption_and_pattern.js
@@ -43,7 +43,7 @@ function SCAPRow() {
                 window.openDialog(
                     xulG.url_prefix("XUL_SERIAL_PATTERN_WIZARD"),
                     "pattern_wizard",
-                    "width=800",
+                    "width=800,height=400",
                     function(value) {
                         self.controls.pattern_code.value = value;
                         self.controls.pattern_code.onchange();

commit c45d702d26a423f8136c52e8659ae5d229a99220
Author: Thomas Berezansky <tsbere at mvlc.org>
Date:   Thu Jul 26 16:18:02 2012 -0400

    Fix pattern wizard
    
    CSS3 selectors break things. And some height would be nice.
    
    Signed-off-by: Thomas Berezansky <tsbere at mvlc.org>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/xul/staff_client/server/serial/pattern_wizard.js b/Open-ILS/xul/staff_client/server/serial/pattern_wizard.js
index 6874719..68c58d3 100644
--- a/Open-ILS/xul/staff_client/server/serial/pattern_wizard.js
+++ b/Open-ILS/xul/staff_client/server/serial/pattern_wizard.js
@@ -245,7 +245,7 @@ function RegularityRow() {
 
     this.allow_year_split = function(yes) {
         dojo.attr(
-            dojo.query("[name='type_and_code_pattern'] [value='y:YYYY']")[0],
+            dojo.query("[value='y:YYYY']",dojo.query("[name='type_and_code_pattern']")[0])[0],
             "disabled",
             !yes
         );
@@ -423,10 +423,11 @@ function CalendarChangeEditor() {
         this.template.removeAttribute("id");
 
         [
-            dojo.query("[name='month'] menupopup", this.template)[0],
-            dojo.query("[name='date_month'] menupopup", this.template)[0]
+            dojo.query("[name='month']", this.template)[0],
+            dojo.query("[name='date_month']", this.template)[0]
         ].forEach(
             function(menupopup) {
+                menupopup = dojo.query("menupopup", menupopup)[0];
                 _menulist(
                     _chronstants.month.values,
                     _chronstants.month.names,
diff --git a/Open-ILS/xul/staff_client/server/serial/scap_editor.js b/Open-ILS/xul/staff_client/server/serial/scap_editor.js
index fef8a0f..31b1e52 100644
--- a/Open-ILS/xul/staff_client/server/serial/scap_editor.js
+++ b/Open-ILS/xul/staff_client/server/serial/scap_editor.js
@@ -142,7 +142,7 @@ serial.scap_editor.prototype = {
         window.openDialog(
             xulG.url_prefix("XUL_SERIAL_PATTERN_WIZARD"),
             "pattern_wizard",
-            "width=800",
+            "width=800,height=400",
             onsubmit
         );
     },

commit d320a7e659dfbf7768e8191d0edeb6bf0f9c1dcc
Author: Thomas Berezansky <tsbere at mvlc.org>
Date:   Thu Jul 26 15:52:35 2012 -0400

    More oils:// wrapping
    
    To avoid breaking some newer interfaces in particular.
    
    Signed-off-by: Thomas Berezansky <tsbere at mvlc.org>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/xul/staff_client/chrome/content/main/constants.js b/Open-ILS/xul/staff_client/chrome/content/main/constants.js
index 70041d6..866700e 100644
--- a/Open-ILS/xul/staff_client/chrome/content/main/constants.js
+++ b/Open-ILS/xul/staff_client/chrome/content/main/constants.js
@@ -398,7 +398,7 @@ var urls = {
     'AUDIO_circ_bad' : '/xul/server/skin/media/audio/question.wav',
     'AUDIO_event_ASSET_COPY_NOT_FOUND' : '/xul/server/skin/media/audio/redalert.wav',
 
-    'AUTHORITY_MANAGE' : '/eg/cat/authority/list',
+    'AUTHORITY_MANAGE' : 'oils://remote/eg/cat/authority/list',
     'MANAGE_MULTI_HOME_ITEMS' : 'oils://remote/xul/server/cat/manage_multi_home_items.xul',
     'XUL_AUTH_SIMPLE' : 'oils://remote/xul/server/main/simple_auth.xul',
     'XUL_BIB_BRIEF' : 'oils://remote/xul/server/cat/bib_brief.xul',
@@ -508,10 +508,10 @@ var urls = {
     'EG_WEB_BASE' : 'oils://remote/eg',
     'XUL_LOCAL_ADMIN_BASE' : 'oils://remote/xul/server/admin',
     'XUL_REPORTS' : 'oils://remote/reports/oils_rpt.xhtml',
-    'EG_ACQ_PO_VIEW' : '/eg/acq/po/view',
-    'EG_ACQ_USER_REQUESTS' : '/eg/acq/picklist/user_request',
+    'EG_ACQ_PO_VIEW' : 'oils://remote/eg/acq/po/view',
+    'EG_ACQ_USER_REQUESTS' : 'oils://remote/eg/acq/picklist/user_request',
     'XUL_SERIAL_BATCH_RECEIVE': 'oils://remote/xul/server/serial/batch_receive.xul',
-    'XUL_SERIAL_PATTERN_WIZARD' : '/xul/server/serial/pattern_wizard.xul',
+    'XUL_SERIAL_PATTERN_WIZARD' : 'oils://remote/xul/server/serial/pattern_wizard.xul',
     'CUSTOM_JS' : '/xul/server/skin/custom.js',
     'ACQ_LINEITEM' : 'oils://remote/eg/acq/lineitem/related/',
     'SERIAL_LIST_SUBSCRIPTION' : 'oils://remote/eg/serial/list_subscription',

commit aa19b9626845b940e189839ebc1210193dd5244d
Author: Thomas Berezansky <tsbere at mvlc.org>
Date:   Thu Jul 26 10:00:34 2012 -0400

    Have oilsBasePath include protocol and domain
    
    As seen by the other end, anyway. This fixes some authtoken related issues
    when things like ACQ build links that would otherwise default to http.
    
    Signed-off-by: Thomas Berezansky <tsbere at mvlc.org>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/src/templates/base.tt2 b/Open-ILS/src/templates/base.tt2
index b26a952..0bd3e5e 100644
--- a/Open-ILS/src/templates/base.tt2
+++ b/Open-ILS/src/templates/base.tt2
@@ -10,7 +10,7 @@
         <script type="text/javascript" src="/js/dojo/dojo/dojo.js"></script>
         <script type="text/javascript" src="[% ctx.media_prefix %]/js/dojo/dojo/openils_dojo.js"></script>
         <script type="text/javascript" src="[% ctx.media_prefix %]/js/dojo/opensrf/md5.js"></script>
-        <script type="text/javascript">var oilsBasePath = '[% ctx.base_path %]'</script>
+        <script type="text/javascript">var oilsBasePath = [% IF ctx.base_path.substr(0,1) == '/' %]location.href.replace(RegExp(location.pathname + '.*'),'') +[% END %] '[% ctx.base_path %]'</script>
         <script type="text/javascript" src="[% ctx.media_prefix %]/js/ui/base.js"></script>
         <script type="text/javascript">
             dojo.require("dijit.layout.LayoutContainer");

commit ee8fcf051ca41be9cdf0dec5329b6f616f205992
Author: Thomas Berezansky <tsbere at mvlc.org>
Date:   Thu May 17 12:19:48 2012 -0400

    Switch to XUL for printer settings editor
    
    Because in later versions of XULRunner we apparently can't do bindings
    outside of XUL documents, and messagecatalogs are binding-based.
    
    Signed-off-by: Thomas Berezansky <tsbere at mvlc.org>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/web/opac/locale/en-US/lang.dtd b/Open-ILS/web/opac/locale/en-US/lang.dtd
index 8180820..3fe1a14 100644
--- a/Open-ILS/web/opac/locale/en-US/lang.dtd
+++ b/Open-ILS/web/opac/locale/en-US/lang.dtd
@@ -3681,7 +3681,7 @@
 <!ENTITY staff.printing.advanced.custom_print.warning.header "Note on Custom/External Print">
 <!ENTITY staff.printing.advanced.custom_print.warning.text "This print strategy will ignore the printer settings in the &quot;Normal Settings&quot; section. Advanced templates using Javascript may not work, even if the external tool can take the receipt.html file.">
 <!ENTITY staff.printing.advanced.html_templates.warning.header "Also...">
-<!ENTITY staff.printing.advanced.html_templates.warning.text "If using Receipt Templates with either the DOS LPT1 Print strategy or the Custom/External Print strategy (with &quot;receipt.txt&quot;), the client will try to translate any HTML markup to text, but this process may be imperfect, and for the best fidelity you should consider reworking your templates to be plain text if you are using a plain text print strategy.  However, if using a plain text print strategy with HTML markup, you may include special character codes in 2-digit hexadecimal in a &quot;hex&quot; attribute for any given element.  Such codes will be converted to actual characters and inserted at the place of the tag.  For example, &amp;lt;p hex=&amp;quot;0C&amp;quot;&amp;gt;Hello World&amp;lt;/p&amp;gt; will translate to form feed control character + Hello World. &amp;lt;p&amp;gt;Hello World&amp;lt;/p hex=&amp;quot;0C&amp;quot;&amp;gt; will translate to Hello World + form feed control character.">
+<!ENTITY staff.printing.advanced.html_templates.warning.text "If using Receipt Templates with either the DOS LPT1 Print strategy or the Custom/External Print strategy (with &quot;receipt.txt&quot;), the client will try to translate any HTML markup to text, but this process may be imperfect, and for the best fidelity you should consider reworking your templates to be plain text if you are using a plain text print strategy.  However, if using a plain text print strategy with HTML markup, you may include special character codes in 2-digit hexadecimal in a &quot;hex&quot; attribute for any given element.  Such codes will be converted to actual characters and inserted at the place of the tag.  For example, &lt;p hex=&quot;0C&quot;&gt;Hello World&lt;/p&gt; will translate to form feed control character + Hello World. &lt;p&gt;Hello World&lt;/p hex=&quot;0C&quot;&gt; will translate to Hello World + form feed control character.">
 <!ENTITY staff.client.portal.title "Evergreen Staff Client Portal">
 <!ENTITY staff.client.portal.welcome "Welcome to Evergreen">
 <!ENTITY staff.client.portal.circpatron "Circulation and Patrons">
diff --git a/Open-ILS/xul/staff_client/chrome/content/main/menu.js b/Open-ILS/xul/staff_client/chrome/content/main/menu.js
index a3bd477..d7fb3b4 100644
--- a/Open-ILS/xul/staff_client/chrome/content/main/menu.js
+++ b/Open-ILS/xul/staff_client/chrome/content/main/menu.js
@@ -705,7 +705,7 @@ main.menu.prototype = {
             ],
             'cmd_local_admin_printer' : [
                 ['oncommand'],
-                function(event) { open_admin_page('printer_settings.html', 'menu.cmd_local_admin_printer.tab', true, event); }
+                function(event) { open_admin_page('printer_settings.xul', 'menu.cmd_local_admin_printer.tab', false, event); }
             ],
             'cmd_local_admin_do_not_auto_attempt_print_setting' : [
                 ['oncommand'],
diff --git a/Open-ILS/xul/staff_client/server/admin/index.xhtml b/Open-ILS/xul/staff_client/server/admin/index.xhtml
index 1e41098..ea4a3f1 100644
--- a/Open-ILS/xul/staff_client/server/admin/index.xhtml
+++ b/Open-ILS/xul/staff_client/server/admin/index.xhtml
@@ -56,7 +56,7 @@
                                 <a href='javascript:_l("font_settings.xul");'>&staff.server.admin.index.fonts_and_sounds;</a>
                             </div>
                             <div style='padding: 8px;'>
-                                <a href='javascript:_l("printer_settings.html");'>&staff.server.admin.index.printer;</a>
+                                <a href='javascript:_l("printer_settings.xul");'>&staff.server.admin.index.printer;</a>
                             </div>
                         </td><td>
                             <div style='padding: 8px;'>
diff --git a/Open-ILS/xul/staff_client/server/admin/printer_settings.html b/Open-ILS/xul/staff_client/server/admin/printer_settings.html
deleted file mode 100644
index 4998ba7..0000000
--- a/Open-ILS/xul/staff_client/server/admin/printer_settings.html
+++ /dev/null
@@ -1,61 +0,0 @@
-<?xml version='1.0' encoding="UTF-8"?>
-
-<!DOCTYPE html PUBLIC
-    "-//W3C//DTD XHTML 1.0 Transitional//EN"
-    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" [
-    <!--#include virtual="/opac/locale/${locale}/lang.dtd"-->
-]>
-
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-    <style type='text/css'>
-        .messagecatalog { -moz-binding: url( /xul/server/main/bindings.xml#messagecatalog ) }
-    </style>
-    <script type="text/javascript" src="/opac/common/js/utils.js"></script>
-    <script type="text/javascript" src="/opac/common/js/CGI.js"></script>
-    <script type="text/javascript" src="/opac/common/js/md5.js"></script>
-    <script type="text/javascript" src="/opac/common/js/JSON_v1.js"></script>
-    <script type="text/javascript" src="/opac/common/js/fmall.js"></script>
-    <script type="text/javascript" src="/opac/common/js/fmgen.js"></script>
-    <script type="text/javascript" src="/opac/common/js/RemoteRequest.js"></script>
-    <script type='text/javascript' src='/opac/common/js/<!--#echo var="locale"-->/OrgTree.js'></script>
-    <script type="text/javascript" src="/opac/common/js/org_utils.js"></script>
-
-    <script type="text/javascript" src="/xul/server/OpenILS/global_util.js"></script>
-    <script type="text/javascript" src="/xul/server/main/constants.js"></script>
-    <script type="text/javascript" src="/xul/server/main/JSAN.js"></script>
-    <script type="text/javascript" src="printer_settings.js"></script>
-</head><body onload="try { my_init(); } catch(E) { alert(E); }" style="background: white;">
-    <div class="messagecatalog" id="offlineStrings" src="/xul/server/locale/<!--#echo var='locale'-->/offline.properties" />
-    <h1>&staff.printing.context.header;</h1>
-    <p>&staff.printing.context.desc;</p>
-    <form>
-        <input type="radio" name="context" value="default" checked="checked" onclick="g.set_printer_context('default');">&staff.printing.context.radio.default.label;</input>
-        <input type="radio" name="context" value="receipt" onclick="g.set_printer_context('receipt');">&staff.printing.context.radio.receipt.label;</input>
-        <input type="radio" name="context" value="label" onclick="g.set_printer_context('label');">&staff.printing.context.radio.label.label;</input>
-        <input type="radio" name="context" value="mail" onclick="g.set_printer_context('mail');">&staff.printing.context.radio.mail.label;</input>
-        <input type="radio" name="context" value="offline" onclick="g.set_printer_context('offline');">&staff.printing.context.radio.offline.label;</input>
-    </form> 
-    <h1>&staff.printing.normal_settings.header;</h1>
-    <iframe id="sample" src="printer_settings.txt" oils_force_external="true"></iframe><br />
-    <button onclick="try { g.printer_settings(); } catch(E) { alert(E); }">&staff.printing.set_default;</button>
-    <button onclick="try { g.page_settings(); } catch(E) { alert(E); }">&staff.printing.page_settings;</button><br />
-    <h1>&staff.printing.advanced_settings.header;</h1>
-    <form>
-        <input type='checkbox' id='print_silent' onclick='g.toggle_silent_print(event);'>&staff.printing.advanced.mozilla_print.print_silent;</input>
-    </form>
-    <button onclick="try { g.set_print_strategy('webBrowserPrint'); } catch(E) { alert(E); }">&staff.printing.advanced.mozilla_print;</button>
-    <button onclick="try { g.set_print_strategy('dos.print'); } catch(E) { alert(E); }">&staff.printing.advanced.dos_print;</button>
-    <button onclick="try { g.set_print_strategy('custom.print'); } catch(E) { alert(E); }">&staff.printing.advanced.custom_print;</button>
-    <p>
-        <dl>
-            <dt><b>&staff.printing.advanced.dos_print.warning.header;</b></dt>
-            <dd>&staff.printing.advanced.dos_print.warning.text;</dd>
-            <dt><b>&staff.printing.advanced.custom_print.warning.header;</b></dt>
-            <dd>&staff.printing.advanced.custom_print.warning.text;</dd>
-            <dt><b>&staff.printing.advanced.html_templates.warning.header;</b></dt>
-            <dd>&staff.printing.advanced.html_templates.warning.text;</dd>
-        </dl>
-    </p>
-</body></html>
-
diff --git a/Open-ILS/xul/staff_client/server/admin/printer_settings.xul b/Open-ILS/xul/staff_client/server/admin/printer_settings.xul
new file mode 100644
index 0000000..e8f61ae
--- /dev/null
+++ b/Open-ILS/xul/staff_client/server/admin/printer_settings.xul
@@ -0,0 +1,68 @@
+<?xml version='1.0' encoding="UTF-8"?>
+
+<!-- ///////////////////////////////////////////////////////////////////////////////////////////////////////////// -->
+<!-- STYLESHEETS -->
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<?xml-stylesheet href="/xul/server/skin/global.css" type="text/css"?>
+
+<!-- ///////////////////////////////////////////////////////////////////////////////////////////////////////////// -->
+<!-- LOCALIZATION -->
+<!DOCTYPE window PUBLIC "" ""[
+    <!--#include virtual="/opac/locale/${locale}/lang.dtd"-->
+]>
+
+<window id="workstation_printer_settings_edit" onload="try { my_init(); } catch(E) { alert(E); }" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+    <script type="text/javascript" src="/opac/common/js/utils.js"></script>
+    <script type="text/javascript" src="/opac/common/js/CGI.js"></script>
+    <script type="text/javascript" src="/opac/common/js/md5.js"></script>
+    <script type="text/javascript" src="/opac/common/js/JSON_v1.js"></script>
+    <script type="text/javascript" src="/opac/common/js/fmall.js"></script>
+    <script type="text/javascript" src="/opac/common/js/fmgen.js"></script>
+    <script type="text/javascript" src="/opac/common/js/RemoteRequest.js"></script>
+    <script type='text/javascript' src='/opac/common/js/<!--#echo var="locale"-->/OrgTree.js'></script>
+    <script type="text/javascript" src="/opac/common/js/org_utils.js"></script>
+
+    <script type="text/javascript" src="/xul/server/OpenILS/global_util.js"></script>
+    <script type="text/javascript" src="/xul/server/main/constants.js"></script>
+    <script type="text/javascript" src="/xul/server/main/JSAN.js"></script>
+    <script type="text/javascript" src="printer_settings.js"></script>
+    <messagecatalog id="offlineStrings" src="/xul/server/locale/<!--#echo var='locale'-->/offline.properties" />
+    <groupbox>
+        <caption label="&staff.printing.context.header;" />
+        <vbox>
+            <description>&staff.printing.context.desc;</description>
+            <radiogroup orient="horizontal">
+                <radio value="default" checked="checked" oncommand="g.set_printer_context('default');" label="&staff.printing.context.radio.default.label;" />
+                <radio value="receipt" oncommand="g.set_printer_context('receipt');" label="&staff.printing.context.radio.receipt.label;" />
+                <radio value="label" oncommand="g.set_printer_context('label');" label="&staff.printing.context.radio.label.label;" />
+                <radio value="mail" oncommand="g.set_printer_context('mail');" label="&staff.printing.context.radio.mail.label;" />
+                <radio value="offline" oncommand="g.set_printer_context('offline');" label="&staff.printing.context.radio.offline.label;" />
+            </radiogroup>
+        </vbox>
+    </groupbox>
+    <groupbox>
+        <caption label="&staff.printing.normal_settings.header;" />
+        <vbox>
+            <iframe id="sample" src="printer_settings.txt" oils_force_external="true" type="content" style="background-color: white;" />
+            <hbox>
+                <button oncommand="try { g.printer_settings(); } catch(E) { alert(E); }" label="&staff.printing.set_default;" />
+                <button oncommand="try { g.page_settings(); } catch(E) { alert(E); }" label="&staff.printing.page_settings;" />
+            </hbox>
+        </vbox>
+    </groupbox>
+    <groupbox>
+        <caption value="&staff.printing.advanced_settings.header;" />
+        <checkbox id='print_silent' oncommand='g.toggle_silent_print(event);' label="&staff.printing.advanced.mozilla_print.print_silent;" />
+        <hbox>
+            <button oncommand="try { g.set_print_strategy('webBrowserPrint'); } catch(E) { alert(E); }" label="&staff.printing.advanced.mozilla_print;" />
+            <button oncommand="try { g.set_print_strategy('dos.print'); } catch(E) { alert(E); }" label="&staff.printing.advanced.dos_print;" />
+            <button oncommand="try { g.set_print_strategy('custom.print'); } catch(E) { alert(E); }" label="&staff.printing.advanced.custom_print;" />
+        </hbox>
+        <label value="&staff.printing.advanced.dos_print.warning.header;" style="font-weight: bold" />
+        <description>&staff.printing.advanced.dos_print.warning.text;</description>
+        <label value="&staff.printing.advanced.custom_print.warning.header;" style="font-weight: bold" />
+        <description>&staff.printing.advanced.custom_print.warning.text;</description>
+        <label value="&staff.printing.advanced.html_templates.warning.header;" style="font-weight: bold" />
+        <description>&staff.printing.advanced.html_templates.warning.text;</description>
+    </groupbox>
+</window>

commit adee850f88dcedfd65a19d41a7fb4948d4c7eee3
Author: Thomas Berezansky <tsbere at mvlc.org>
Date:   Mon Feb 27 09:03:51 2012 -0500

    Improve Firefox/XULRunner Support
    
    XULRunner/Firefox 4+ change the rules significantly, and to support them
    significant changes have to be made in Evergreen.
    
    This commit covers a number of things:
    
    1 - Remote XUL Issues
    
    Later versions of XULRunner disable support for Remote XUL without using a
    whitelist entry, and whitelisting may stop working eventually as well. The
    solution here is the addition of a new protocol wrapper that allows Remote
    XUL to act like Local XUL.
    
    The wrapper is oils:// and acts like HTTPS for the most part. The "host" the
    client connects to is always "remote", however, and use of the wrapper has
    multiple effects.
    
    The first of these effects is the enabling of Remote XUL content, with as
    close to the Local XUL security level as I could manage. This means that
    nearly anything Local XUL can do, Remote XUL should be able to do too.
    
    The second of these effects is the disabling of JavaScript-visible cookies.
    XUL doesn't have cookies, and as such a side effect of the wrapper allowing
    remote content to appear to be local content is the lack of cookies. This
    does *not* affect server side visibility of cookies, however, so things like
    TPac can still see cookies. This required fixing a lot of places that were
    built to read data like authtokens out of cookies.
    
    The third of these effects is the "hiding" of the hostname for anything
    going through the wrapper. This prevents oils_persist from saving things
    correctly. I thus made oils_persist check for the wrapper and use the data
    stash to get the hostname instead. I suspect that we can get rid of the
    location.hostname check entirely at this point, but have not done so.
    
    The wrapper also sets a request header of OILS-Wrapper, value of 'true'.
    That allows the server to know that the request came through the wrapper. I
    used that ability to have TPac go into "Staff" mode when the wrapper is in
    use. This will enhance extension use, where the same authtoken will be seen
    by both the staff client and Firefox browsing.
    
    I willi also  note that I rigged the wrapper to be easily adjusted for a
    second, hard-coded host for selfcheck use, using oils://selfcheck instead of
    oils://remote, that could be very easily turned into a minimal Firefox
    extension. That would enable the selfcheck code to have permission to work
    with printers and such without enablePrivilege (see next section).
    
    2 - enablePrivilege Deprecation
    
    The enablePrivilege security model has been removed and no longer functions,
    and the staff client depended heavily upon it.
    
    The Remote XUL fix provided us with a way to fix the enablePrivilege issues,
    however. Because the Remote XUL has the Local XUL security context it
    doesn't need enablePrivilege anymore. However, because enablePrivilege no
    longer functions for those things *not* loaded through the wrapper some
    things had to be changed.
    
    For one, because if you are loaded through the wrapper you can't see
    cookies, and if you can see cookies you can't do "XUL" things, the "XUL"
    cookie has been removed. However, the wrapper can be detected by the
    protocol you are using, so I added protocol checking to the isXUL checks I
    know of. I am unsure about what, if anything, to do about the IAMXUL flag
    that is set by the browser code, though.
    
    For two, the JavaScript OPAC needs to be passed through the wrapper for some
    staff functions to work currently. This has the additional side effect of
    effectively forcing SSL mode for JSPac regardless of other settings.
    
    For three, I went ahead and removed all enablePrivilege calls I could find
    outside of the selfcheck code. As they no longer work they were just extra
    cruft.
    
    3 - Component changes
    
    Component loading has changed significantly, and the easiest way to
    accommodate the changes was to re-write our components. The command line
    handler and force external components (the latter from another branch of
    mine) were simple enough, especially as they aren't interacted with by other
    code in the system (and as I wrote them I understood them anyway). While I
    was at it I made the force external component more extension-friendly.
    
    The data stash, however, was using a hack to accomplish what a singleton
    component could do more easily. That and I couldn't get it to function as
    it was. My solution was to re-write it as a singleton, removing the
    interface definition that was not needed. As I changed how it functioned so
    significantly I had to update all calls to it.
    
    In addition, I hid a window loading routine in the data stash component for
    easier loading of a *single* main Evergreen window from the Firefox
    overlays.
    
    4 - Extension changes
    
    First off, Venkman, the DOM Inspector, and Chrome List are not guaranteed
    compatible with XULRunner anymore. As such, I have removed the out of date
    versions. Instead, I have added routines for loading Venkman and the DOM
    Inspector as Extensions. This keeps them easy to update to later versions,
    and makes us play much nicer when we are an extension. Also, now the
    buttons/menu items for loading these interfaces disable themselves if the
    extensions don't appear to be loaded.
    
    A side effect of that was that Windows installers compressed with zlib were
    unhappy. I switched to solid lzma, which in theory will get us smaller file
    sizes too.
    
    Secondly, Extensions have changed significantly in Firefox 4+, and Evergreen
    had to be adjusted to deal with some of the changes. I adjusted the overlay
    to take into account the new application menu, and I re-wrote the hotkey set
    loading routines to deal with the fact that extensions don't get extracted
    by default.
    
    5 - Staff Client Build Process
    
    XULRunner has some changes that needed accounting for, such as a root level
    chrome.manifest being needed. Extension mode, as mentioned above, needed
    tweaks as well, and other issues were run into along the way. Both XULRunner
    and Firefox version support has been extended to 14.* and the base XULRunner
    download has been bumped to 14.0.1.
    
    In addition to the changes needed to support later XULRunner versions, I
    also included alternate application name support and support for OS-specific
    branding folders. Mainly because I ended up using all of them in testing,
    and decided to leave them in afterwards.
    
    6 - Miscellaneous fixes
    
    MARC View was building a data URL and dumping it into an attribute without
    escaping it. Apparently this made XULRunner unhappy, so I added in escaping.
    
    7 - Miscellaneous tweaks
    
    In addition to everything else, while I was running through my various tests
    I changed a few other things.
    
    I enabled the navigation buttons on the OPAC interface embedded in the
    patron overview for hold placement. With Remote XUL having the same security
    context as Local XUL they now work.
    
    I removed all non-SSL authtoken cookie assignments I could find, and flagged
    all the SSL ones I could find as being "secure" cookies. On the subject of
    cookies, I also told the logoff code to not erase every cookie, as those
    running in extension mode might dislike all cookies going away. I know that
    during my testing I disliked it, anyway.
    
    I removed the code that messes with the user agent. Extensions are basically
    not allowed to do that, and I don't think we need, or should rely on, a
    modified user agent elsewhere, so adding a check specifically for when we
    are not an extension didn't make a lot of sense to me.
    
    I also made it so that the automatic login command line options will work
    after a logoff (but they won't trigger a logoff) during a testing run where
    I was logging off, clearing cache, and logging in again repeatedly.
    
    To deal with CSS changes I changed most (but not all) popup elements to
    menupop elements. Popups in later XULRunners are transparent by default.
    
    Also for CSS changes, a menubar CSS entry in global.css was causing issues
    with menu visibility on Linux. Things look fine without it, so I went ahead
    and removed it outright.
    
    In the reporter I found that "class" was being used as a variable name, but
    that is a reserved keyword. I changed it to aClass.
    
    To make things easier for url_prefix use I made it so that the urls hash is
    checked by the url_prefix function. It looks for names up to the first of
    several characters: /, ?, |. If urls contains that name it is replaced into
    place. For | the | itself is removed in this process.
    
    Signed-off-by: Thomas Berezansky <tsbere at mvlc.org>
    Signed-off-by: Dan Scott <dscott at laurentian.ca>

diff --git a/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm b/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm
index 64903e9..1f31081 100644
--- a/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm
+++ b/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm
@@ -246,7 +246,8 @@ sub load_common {
     $ctx->{full_path} = $ctx->{base_path} . $self->cgi->path_info;
     $ctx->{unparsed_uri} = $self->apache->unparsed_uri;
     $ctx->{opac_root} = $ctx->{base_path} . "/opac"; # absolute base url
-    $ctx->{is_staff} = 0; # Assume false, check for workstation id later.  Was: ($self->apache->headers_in->get('User-Agent') =~ /oils_xulrunner/);
+    $ctx->{is_staff} = ($self->apache->headers_in->get('OILS-Wrapper') =~ /true/);
+    $ctx->{proto} = 'oils' if $ctx->{is_staff};
     $ctx->{physical_loc} = $self->get_physical_loc;
 
     # capture some commonly accessed pages
@@ -265,7 +266,6 @@ sub load_common {
                 'open-ils.actor', 
                 'open-ils.actor.user.opac.vital_stats', 
                 $e->authtoken, $e->requestor->id);
-            $ctx->{is_staff} = 1 if $e->requestor->wsid;
 
         } else {
 
diff --git a/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy.pm b/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy.pm
index c3eddbf..c9a85af 100644
--- a/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy.pm
+++ b/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy.pm
@@ -109,7 +109,8 @@ sub handler {
 				-cookie=>$cgi->cookie(
 					-name=>'ses',
 					-value=>$auth_ses,
-					-path=>'/'
+					-path=>'/',
+					-secure=>1
 				)
 			);
 			return Apache2::Const::REDIRECT;
diff --git a/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy/Authen.pm b/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy/Authen.pm
index d6ca65e..5bf6c14 100644
--- a/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy/Authen.pm
+++ b/Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy/Authen.pm
@@ -74,7 +74,8 @@ sub handler {
                     $cookie = $cgi->cookie(
                         -name=>'ses',
                         -value=>$auth_ses,
-                        -path=>'/'
+                        -path=>'/',
+                        -secure=>1
                     );
                 }
             }
diff --git a/Open-ILS/src/templates/opac/parts/footer.tt2 b/Open-ILS/src/templates/opac/parts/footer.tt2
index 76c6b7a..2368055 100644
--- a/Open-ILS/src/templates/opac/parts/footer.tt2
+++ b/Open-ILS/src/templates/opac/parts/footer.tt2
@@ -1,10 +1,6 @@
-[%- 
-    USE CGI = CGI_utf8;
-    hostname = CGI.url({'-base' => 1});
--%]
 <div id="footer-wrap">
 <div id="footer">
-    <a href="[% hostname %]">[% l('Dynamic catalog') %]</a> &nbsp;|&nbsp;
+    <a href="/">[% l('Dynamic catalog') %]</a> &nbsp;|&nbsp;
     <a href="http://example.com">[% l('Bottom Link 2') %]</a> &nbsp;|&nbsp;
     <a href="http://example.com">[% l('Bottom Link 3') %]</a> &nbsp;|&nbsp;
     <a href="http://example.com">[% l('Bottom Link 4') %]</a> &nbsp;|&nbsp;
diff --git a/Open-ILS/src/templates/opac/parts/header.tt2 b/Open-ILS/src/templates/opac/parts/header.tt2
index ba75412..e069b6e 100644
--- a/Open-ILS/src/templates/opac/parts/header.tt2
+++ b/Open-ILS/src/templates/opac/parts/header.tt2
@@ -82,7 +82,7 @@
             END;
         ELSE;
             # staying on the current page
-            cgi.url("-path" => 1, "-query" => 1) _ final;
+            cgi.url("-absolute" => 1, "-path" => 1, "-query" => 1) _ final;
         END;
     END;
 
diff --git a/Open-ILS/web/conify/global/actor/org_unit.js b/Open-ILS/web/conify/global/actor/org_unit.js
index 41cc5e8..501193e 100644
--- a/Open-ILS/web/conify/global/actor/org_unit.js
+++ b/Open-ILS/web/conify/global/actor/org_unit.js
@@ -35,11 +35,16 @@ dojo.require('dijit.layout.LayoutContainer');
 dojo.require('dijit.layout.SplitContainer');
 dojo.require('dojox.widget.Toaster');
 dojo.require('dojox.fx');
+dojo.require('openils.XUL');
 dojo.requireLocalization("openils.conify", "conify");
 
 // some handy globals
 var cgi = new CGI();
 var ses = dojo.cookie('ses') || cgi.param('ses');
+if(!ses && openils.XUL.isXUL()) {
+    var stash = openils.XUL.getStash();
+    ses = stash.session.key;
+}
 var pcrud = new openils.PermaCrud({ authtoken : ses });
 
 var current_ou, current_ou_hoo, ou_list_store;
diff --git a/Open-ILS/web/conify/global/actor/org_unit_type.js b/Open-ILS/web/conify/global/actor/org_unit_type.js
index 26cb07d..13170c0 100644
--- a/Open-ILS/web/conify/global/actor/org_unit_type.js
+++ b/Open-ILS/web/conify/global/actor/org_unit_type.js
@@ -36,11 +36,16 @@ dojo.require('dijit.layout.LayoutContainer');
 dojo.require('dijit.layout.SplitContainer');
 dojo.require('dojox.widget.Toaster');
 dojo.require('dojox.fx');
+dojo.require('openils.XUL');
 dojo.requireLocalization("openils.conify", "conify");
 
 // some handy globals
 var cgi = new CGI();
 var ses = dojo.cookie('ses') || cgi.param('ses');
+if(!ses && openils.XUL.isXUL()) {
+    var stash = openils.XUL.getStash();
+    ses = stash.session.key;
+}
 var pCRUD = new openils.PermaCrud({authtoken:ses});
 
 var current_type;
diff --git a/Open-ILS/web/conify/global/config/copy_status.js b/Open-ILS/web/conify/global/config/copy_status.js
index 1613ae8..fc0d883 100644
--- a/Open-ILS/web/conify/global/config/copy_status.js
+++ b/Open-ILS/web/conify/global/config/copy_status.js
@@ -32,11 +32,16 @@ dojo.require('dijit.layout.BorderContainer');
 dojo.require('dojox.widget.Toaster');
 dojo.require('dojox.fx');
 dojo.require('dojox.grid.Grid');
+dojo.require('openils.XUL');
 dojo.requireLocalization("openils.conify", "conify");
 
 // some handy globals
 var cgi = new CGI();
 var ses = dojo.cookie('ses') || cgi.param('ses');
+if(!ses && openils.XUL.isXUL()) {
+    var stash = openils.XUL.getStash();
+    ses = stash.session.key;
+}
 var pCRUD = new openils.PermaCrud({authtoken:ses});
 
 var current_status;
diff --git a/Open-ILS/web/conify/global/config/marc_code_maps.js b/Open-ILS/web/conify/global/config/marc_code_maps.js
index 4589a98..26fb16f 100644
--- a/Open-ILS/web/conify/global/config/marc_code_maps.js
+++ b/Open-ILS/web/conify/global/config/marc_code_maps.js
@@ -34,6 +34,7 @@ dojo.require('dijit.layout.BorderContainer');
 dojo.require('dojox.widget.Toaster');
 dojo.require('dojox.fx');
 dojo.require('dojox.grid.Grid');
+dojo.require('openils.XUL');
 dojo.requireLocalization("openils.conify", "conify");
 
 console.log('loading marc_code_maps.js');
@@ -41,6 +42,10 @@ console.log('loading marc_code_maps.js');
 // some handy globals
 var cgi = new CGI();
 var ses = dojo.cookie('ses') || cgi.param('ses');
+if(!ses && openils.XUL.isXUL()) {
+    var stash = openils.XUL.getStash();
+    ses = stash.session.key;
+}
 var pCRUD = new openils.PermaCrud({authtoken:ses});
 
 console.log('initialized pcrud session');
diff --git a/Open-ILS/web/conify/global/permission/grp_tree.js b/Open-ILS/web/conify/global/permission/grp_tree.js
index 1ee39d3..b4bacce 100644
--- a/Open-ILS/web/conify/global/permission/grp_tree.js
+++ b/Open-ILS/web/conify/global/permission/grp_tree.js
@@ -40,11 +40,16 @@ dojo.require('dijit.layout.SplitContainer');
 dojo.require('dojox.widget.Toaster');
 dojo.require('dojox.fx');
 dojo.require('dojox.grid.Grid');
+dojo.require('openils.XUL');
 dojo.requireLocalization("openils.conify", "conify");
 
 // some handy globals
 var cgi = new CGI();
 var ses = dojo.cookie('ses') || cgi.param('ses');
+if(!ses && openils.XUL.isXUL()) {
+    var stash = openils.XUL.getStash();
+    ses = stash.session.key;
+}
 var server = {};
 server.pcrud = new openils.PermaCrud({ authtoken : ses });
 server.actor = new OpenSRF.ClientSession('open-ils.actor');
diff --git a/Open-ILS/web/conify/global/permission/perm_list.js b/Open-ILS/web/conify/global/permission/perm_list.js
index ff303f9..9de5a90 100644
--- a/Open-ILS/web/conify/global/permission/perm_list.js
+++ b/Open-ILS/web/conify/global/permission/perm_list.js
@@ -32,11 +32,16 @@ dojo.require('dijit.layout.BorderContainer');
 dojo.require('dojox.widget.Toaster');
 dojo.require('dojox.fx');
 dojo.require('dojox.grid.Grid');
+dojo.require('openils.XUL');
 dojo.requireLocalization("openils.conify", "conify");
 
 // some handy globals
 var cgi = new CGI();
 var ses = dojo.cookie('ses') || cgi.param('ses');
+if(!ses && openils.XUL.isXUL()) {
+    var stash = openils.XUL.getStash();
+    ses = stash.session.key;
+}
 var pCRUD = new openils.PermaCrud({authtoken : ses});
 
 var ppl_strings = dojo.i18n.getLocalization('openils.conify', 'conify');
diff --git a/Open-ILS/web/js/dojo/openils/XUL.js b/Open-ILS/web/js/dojo/openils/XUL.js
index a7f4bfc..9385091 100644
--- a/Open-ILS/web/js/dojo/openils/XUL.js
+++ b/Open-ILS/web/js/dojo/openils/XUL.js
@@ -5,7 +5,8 @@ if(!dojo._hasResource["openils.XUL"]) {
     dojo.declare('openils.XUL', null, {});
 
     openils.XUL.isXUL = function() {
-        return Boolean(dojo.cookie('xul')) || Boolean(window.IAMXUL);
+        if(location.protocol == 'chrome:' || location.protocol == 'oils:') return true;
+        return Boolean(window.IAMXUL);
     }
 
  try {
@@ -16,11 +17,8 @@ if(!dojo._hasResource["openils.XUL"]) {
     openils.XUL.getStash = function() {
         if(openils.XUL.isXUL()) {
             try {
-                if(openils.XUL.enableXPConnect()) {
-                    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
-                    var CacheClass = new Components.Constructor("@mozilla.org/openils_data_cache;1", "nsIOpenILS");
-                    return new CacheClass().wrappedJSObject.OpenILS.prototype.data;
-                }
+                var CacheClass = Components.classes["@open-ils.org/openils_data_cache;1"].getService();
+                return CacheClass.wrappedJSObject.data;
             } catch(e) {
                 console.log("Error loading XUL stash: " + e);
                 return { 'error' : e };
@@ -78,23 +76,6 @@ if(!dojo._hasResource["openils.XUL"]) {
         return xulG.get_new_session({callback : callback});
     }
 
-    /** 
-     * This can be used by privileged Firefox in addition to XUL.
-     * To use use in Firefox directly, set signed.applets.codebase_principal_support to true in about:config
-     */ 
-    openils.XUL.enableXPConnect = function() {
-        try {
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
-        } catch (E) {
-            if(dojo.isFF) {
-                console.error("Unable to enable UniversalXPConnect privileges.  " +
-                    "Try setting 'signed.applets.codebase_principal_support' to true in about:config");
-            }
-            return false;
-        }
-        return true;
-    }
-
     /* This class cuts down on the obscenely long incantations needed to
      * use XPCOM components. */
     openils.XUL.SimpleXPCOM = function() {};
@@ -118,20 +99,12 @@ if(!dojo._hasResource["openils.XUL"]) {
         "create": function(key) {
             return Components.classes[this[key].cls].
                 createInstance(this[key].iface);
-        },
-        "getPrivilegeManager": function() {
-            return netscape.security.PrivilegeManager;
         }
     };
 
     openils.XUL.contentFromFileOpenDialog = function(windowTitle, sizeLimit) {
         var api = new openils.XUL.SimpleXPCOM();
 
-        /* The following enablePrivilege() call must happen at this exact
-         * level of scope -- not wrapped in another function -- otherwise
-         * it doesn't work. */
-        api.getPrivilegeManager().enablePrivilege("UniversalXPConnect");
-
         var picker = api.create("FP");
         picker.init(
             window, windowTitle || "Upload File", api.FP.iface.modeOpen
@@ -151,7 +124,6 @@ if(!dojo._hasResource["openils.XUL"]) {
 
     openils.XUL.contentToFileSaveDialog = function(content, windowTitle, dispositionArgs) {
         var api = new openils.XUL.SimpleXPCOM();
-        api.getPrivilegeManager().enablePrivilege("UniversalXPConnect");
 
         var picker = api.create("FP");
         picker.init(
diff --git a/Open-ILS/web/js/dojo/openils/widget/TranslatorPopup.js b/Open-ILS/web/js/dojo/openils/widget/TranslatorPopup.js
index 5c0be1e..e301746 100644
--- a/Open-ILS/web/js/dojo/openils/widget/TranslatorPopup.js
+++ b/Open-ILS/web/js/dojo/openils/widget/TranslatorPopup.js
@@ -31,6 +31,7 @@ if(!dojo._hasResource["openils.widget.TranslatorPopup"]) {
 	dojo.require("dijit.form.TextBox");
 	dojo.require("dijit.form.FilteringSelect");
 	dojo.require("dojox.jsonPath");
+    dojo.require('openils.XUL');
 	dojo.requireLocalization("openils.widget", "TranslatorPopup");
 
 
@@ -211,8 +212,13 @@ if(!dojo._hasResource["openils.widget.TranslatorPopup"]) {
 			
 				var _trans_dijit = this;
 
-                if (typeof(ses) == "undefined")
+                if (typeof(ses) == "undefined") {
                     var ses = cgi.param("ses") || dojo.cookie("ses");
+                    if(!ses && openils.XUL.isXUL()) {
+                        var stash = openils.XUL.getStash();
+                        ses = stash.session.key;
+                    }
+                }
 
 				OpenSRF.CachedClientSession('open-ils.permacrud').request({
 					method : 'open-ils.permacrud.' + method + '.i18n',
diff --git a/Open-ILS/web/js/ui/base.js b/Open-ILS/web/js/ui/base.js
index 4f5c3e7..8a6d7c9 100644
--- a/Open-ILS/web/js/ui/base.js
+++ b/Open-ILS/web/js/ui/base.js
@@ -62,7 +62,7 @@ function oilsSetupUser() {
         }
     }
 
-    dojo.cookie('ses', authtoken, {path:'/'});
+    dojo.cookie('ses', authtoken, {path:'/', 'secure' : true});
     openils.User.authtoken = authtoken;
     openils.User.workstation = workstation;
     return authtoken;
diff --git a/Open-ILS/web/js/ui/default/acq/common/li_table.js b/Open-ILS/web/js/ui/default/acq/common/li_table.js
index 6495c87..f9abb71 100644
--- a/Open-ILS/web/js/ui/default/acq/common/li_table.js
+++ b/Open-ILS/web/js/ui/default/acq/common/li_table.js
@@ -1090,7 +1090,7 @@ function AcqLiTable() {
                     no_xulG : false, 
                     show_nav_buttons : true, 
                     show_print_button : true, 
-                    opac_url : xulG.url_prefix(xulG.urls.opac_rdetail + bib_id),
+                    opac_url : xulG.url_prefix('opac_rdetail|' + bib_id),
                     default_view : default_view
                 }
             );
@@ -2661,8 +2661,6 @@ function AcqLiTable() {
         /*  To run in Firefox directly, must set signed.applets.codebase_principal_support
             to true in about:config */
 
-        if(!openils.XUL.enableXPConnect()) return;
-
         if(openils.XUL.isXUL()) {
             win = window.open('/xul/' + openils.XUL.buildId() + '/server/cat/marcedit.xul');
         } else {
diff --git a/Open-ILS/web/js/ui/default/actor/user/register.js b/Open-ILS/web/js/ui/default/actor/user/register.js
index dd0a735..eee5569 100644
--- a/Open-ILS/web/js/ui/default/actor/user/register.js
+++ b/Open-ILS/web/js/ui/default/actor/user/register.js
@@ -1210,7 +1210,6 @@ function attachWidgetEvents(fmcls, fmfield, widget) {
         widget.widget,
         'onKeyPress',
         function(ev){
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             if (!(ev.altKey || ev.ctrlKey || ev.metaKey)) {
                 if (lock_ready && xulG && typeof xulG.lock_tab == 'function') {
                     if (! already_locked) {
diff --git a/Open-ILS/web/js/ui/default/cat/authority/list.js b/Open-ILS/web/js/ui/default/cat/authority/list.js
index 1d1e4c4..99fba63 100644
--- a/Open-ILS/web/js/ui/default/cat/authority/list.js
+++ b/Open-ILS/web/js/ui/default/cat/authority/list.js
@@ -281,7 +281,6 @@ function loadMarcEditor(pcrud, rec) {
        To run in Firefox directly, must set signed.applets.codebase_principal_support
        to true in about:config
      */
-    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
     win = window.open('/xul/server/cat/marcedit.xul'); // XXX version?
 
     win.xulG = {
diff --git a/Open-ILS/web/js/ui/default/serial/subscription.js b/Open-ILS/web/js/ui/default/serial/subscription.js
index d3e3d4b..2cfac2f 100644
--- a/Open-ILS/web/js/ui/default/serial/subscription.js
+++ b/Open-ILS/web/js/ui/default/serial/subscription.js
@@ -157,7 +157,7 @@ function open_batch_receive() {
         return;
     }
 
-    var url = "/xul/server/serial/batch_receive.xul?docid=" +
+    var url = "XUL_SERIAL_BATCH_RECEIVE?docid=" +
         sub.record_entry() + "&subid=" + sub.id();
 
     try {
diff --git a/Open-ILS/web/js/ui/default/serial/subscription/caption_and_pattern.js b/Open-ILS/web/js/ui/default/serial/subscription/caption_and_pattern.js
index 5382de9..a17c75f 100644
--- a/Open-ILS/web/js/ui/default/serial/subscription/caption_and_pattern.js
+++ b/Open-ILS/web/js/ui/default/serial/subscription/caption_and_pattern.js
@@ -40,11 +40,8 @@ function SCAPRow() {
                 return;
             }
             try {
-                netscape.security.PrivilegeManager.enablePrivilege(
-                    "UniversalXPConnect"
-                );
                 window.openDialog(
-                    xulG.url_prefix("/xul/server/serial/pattern_wizard.xul"),
+                    xulG.url_prefix("XUL_SERIAL_PATTERN_WIZARD"),
                     "pattern_wizard",
                     "width=800",
                     function(value) {
diff --git a/Open-ILS/web/js/ui/default/vandelay/vandelay.js b/Open-ILS/web/js/ui/default/vandelay/vandelay.js
index 2728b4c..e8b8f5a 100644
--- a/Open-ILS/web/js/ui/default/vandelay/vandelay.js
+++ b/Open-ILS/web/js/ui/default/vandelay/vandelay.js
@@ -1520,7 +1520,6 @@ function vlOpenMarcEditWindow(rec, postReloadHTMLHandler) {
         To run in Firefox directly, must set signed.applets.codebase_principal_support
         to true in about:config
     */
-    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
     win = window.open('/xul/server/cat/marcedit.xul'); // XXX version?
 
     var type;
diff --git a/Open-ILS/web/opac/common/js/RemoteRequest.js b/Open-ILS/web/opac/common/js/RemoteRequest.js
index ae43f11..bf65c78 100644
--- a/Open-ILS/web/opac/common/js/RemoteRequest.js
+++ b/Open-ILS/web/opac/common/js/RemoteRequest.js
@@ -213,8 +213,7 @@ RemoteRequest.prototype.send = function(blocking) {
 			url = 'http://'+XML_HTTP_SERVER+'/'+XML_HTTP_GATEWAY;
 
 		if( url.match(/^http:/) && 
-				(this.secure || location.href.match(/^https:/) || location.href.match(/^chrome:/) ) ) {
-			netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead");
+				(this.secure || location.href.match(/^https:/) || location.href.match(/^chrome:/) || location.href.match(/^oils:/) ) ) {
 			url = url.replace(/^http:/, 'https:');
 		}
 	}
@@ -362,10 +361,8 @@ RemoteRequest.prototype.addParam = function(param) {
 function fetchXULStash() {
 	if( isXUL() ) {
 		try {
-			netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-			var __OILS = new Components.Constructor("@mozilla.org/openils_data_cache;1", "nsIOpenILS");
-			var data_cache = new __OILS( );
-			return data_cache.wrappedJSObject.OpenILS.prototype.data;
+			var __OILS = Components.classes["@open-ils.org/openils_data_cache;1"].getService();
+			return __OILS.wrappedJSObject.data;
 	
 		} catch(E) {
 			_debug('Error in OpenILS.data._debug_stash(): ' + js2JSON(E) );
diff --git a/Open-ILS/web/opac/common/js/opac_utils.js b/Open-ILS/web/opac/common/js/opac_utils.js
index 78557b6..f3a2c43 100644
--- a/Open-ILS/web/opac/common/js/opac_utils.js
+++ b/Open-ILS/web/opac/common/js/opac_utils.js
@@ -2,7 +2,10 @@
 
 
 /* define it again here for pages that don't load RemoteRequest */
-function isXUL() { try { if(IAMXUL) return true;}catch(e){return false;}; }
+function isXUL() {
+    if(location.protocol == 'chrome:' || location.protocol == 'oils:') return true;
+    try { if(IAMXUL) return true;}catch(e){return false;};
+}
 
 
 var __ilsEvent; /* the last event the occurred */
@@ -16,7 +19,7 @@ function Request(type) {
 	var p = [];
 
 	if(isXUL()) {
-		if(!location.href.match(/^https:/))
+		if(!location.href.match(/^https:/) && !location.href.match(/^oils:/))
 			this.request.setSecure(false);
 
 	} else {
@@ -282,6 +285,7 @@ function findBasePath() {
 function findBaseURL(ssl) {
 	var path = findBasePath();
 	var proto = (ssl) ? "https:" : "http:";
+	if(ssl && location.protocol == 'oils:') proto = 'oils:';
 
 	/* strip port numbers.  This is necessary for browsers that
 	send an explicit  <host>:80, 443 - explicit ports
@@ -314,7 +318,6 @@ function _debug(str) {
 	if(!IE) {
 		if(!consoleService) {
 			try {
-				netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 				this.consoleService = Components.classes['@mozilla.org/consoleservice;1']
 					.getService(Components.interfaces.nsIConsoleService);
 			} catch(e) {}
@@ -322,7 +325,6 @@ function _debug(str) {
 	
 		try {
 			if(consoleService) {
-				netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 				consoleService.logStringMessage(str + '\n');
 			}
 		} catch(e){}
@@ -337,7 +339,7 @@ function  buildOPACLink(args, slim, ssl) {
 	var string = "";
 
     if( ssl == undefined && (
-            location.protocol == 'https:' ||
+            location.protocol == 'https:' || location.protocol == 'oils:' ||
             (forceLoginSSL && G.user && G.user.session))) {
         ssl = true;
     }
@@ -521,7 +523,7 @@ function buildSearchLink(type, string, linknode, trunc) {
 }
 
 function setSessionCookie(ses) {
-	dojo.cookie(COOKIE_SES, ses);
+	dojo.cookie(COOKIE_SES, ses, {'secure':'true'});
 }
 
 
diff --git a/Open-ILS/web/opac/extras/circ/alt_holds_print.html b/Open-ILS/web/opac/extras/circ/alt_holds_print.html
index c3fc671..690f01a 100644
--- a/Open-ILS/web/opac/extras/circ/alt_holds_print.html
+++ b/Open-ILS/web/opac/extras/circ/alt_holds_print.html
@@ -38,12 +38,17 @@
         <script type="text/javascript" src="/js/dojo/dijit/dijit.js"></script>
         <script type="text/javascript" src="/js/dojo/openils/User.js"></script>
         <script type="text/javascript" src="/js/dojo/openils/Util.js"></script>
+        <script type="text/javascript" src="/js/dojo/openils/XUL.js"></script>
         <script type="text/javascript" src="/opac/extras/circ/alt_holds_print.js"></script>
         <script type="text/javascript">
             function my_init() {
                 cgi = new CGI();
                 authtoken = (typeof ses == "function" ? ses() : 0) ||
                     cgi.param("ses") || dojo.cookie("ses");
+                if(!authtoken && openils.XUL.isXUL()) {
+                    var stash = openils.XUL.getStash();
+                    authtoken = stash.session.key;
+                }
 
                 if (cgi.param("do") == "shelf_expired_holds") {
                     dojo.query("th[name=barcode_part]")[0].innerHTML = "Barcode";  /* XXX i18n. also, no support for part labels in this interface, at least for now */
diff --git a/Open-ILS/web/opac/skin/default/js/rdetail.js b/Open-ILS/web/opac/skin/default/js/rdetail.js
index 55a1837..2a228f5 100644
--- a/Open-ILS/web/opac/skin/default/js/rdetail.js
+++ b/Open-ILS/web/opac/skin/default/js/rdetail.js
@@ -337,7 +337,6 @@ function OpenMarcEditWindow(pcrud, rec) {
 	   To run in Firefox directly, must set signed.applets.codebase_principal_support
 	   to true in about:config
 	 */
-	netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
 	win = window.open('/xul/server/cat/marcedit.xul'); // XXX version?
 	dojo.require('openils.PermaCrud');
 
diff --git a/Open-ILS/web/reports/oils_rpt.js b/Open-ILS/web/reports/oils_rpt.js
index ef6e7e2..67d6654 100644
--- a/Open-ILS/web/reports/oils_rpt.js
+++ b/Open-ILS/web/reports/oils_rpt.js
@@ -25,8 +25,8 @@ function oilsInitReports() {
 
     dojo.require('dojo.cookie');
 	oilsRptCurrentOrg = USER.ws_ou();
-	dojo.cookie(COOKIE_SES, SESSION, { 'path' : '/'});
-	dojo.cookie('ws_ou', USER.ws_ou(), { 'path' : '/'});
+	dojo.cookie(COOKIE_SES, SESSION, { 'path' : '/', 'secure' : true});
+	dojo.cookie('ws_ou', USER.ws_ou(), { 'path' : '/', 'secure' : true});
 
 	oilsRptFetchOrgTree(
 		function() {
diff --git a/Open-ILS/web/reports/xul/source-setup.js b/Open-ILS/web/reports/xul/source-setup.js
index 7a9ca84..245657b 100644
--- a/Open-ILS/web/reports/xul/source-setup.js
+++ b/Open-ILS/web/reports/xul/source-setup.js
@@ -1,4 +1,5 @@
 dojo.requireLocalization("openils.reports", "reports");
+dojo.require('openils.XUL');
 
 var rpt_strings = dojo.i18n.getLocalization("openils.reports", "reports");
 var idlNS	= "http://opensrf.org/spec/IDL/base/v1";
@@ -39,7 +40,10 @@ function sortLabels (a,b) {
 function loadTemplate(id) {
 	var cgi = new CGI();
 	var session = cgi.param('ses');
-
+    if(!session && openils.XUL.isXUL()) {
+        var stash = openils.XUL.getStash();
+        session = stash.session.key;
+    }
 	var r = new Request('open-ils.reporter:open-ils.reporter.template.retrieve', session, id);
 
 	r.callback(
diff --git a/Open-ILS/web/reports/xul/template-config.js b/Open-ILS/web/reports/xul/template-config.js
index 46c66ac..ddc81e8 100644
--- a/Open-ILS/web/reports/xul/template-config.js
+++ b/Open-ILS/web/reports/xul/template-config.js
@@ -43,8 +43,8 @@ function removeReportAtom (args) {
 	return true;
 }
 
-function getSourceDefinition(class) {
-	var class_obj = getIDLClass(class);
+function getSourceDefinition(aClass) {
+	var class_obj = getIDLClass(aClass);
 	return class_obj.getAttributeNS(persistNS,'tablename') || 
         '(' + class_obj.getElementsByTagNameNS(persistNS,'source_definition')[0].textContent + ')';
 }
diff --git a/Open-ILS/web/reports/xul/template_builder.xul b/Open-ILS/web/reports/xul/template_builder.xul
index 40fffac..2a03b23 100644
--- a/Open-ILS/web/reports/xul/template_builder.xul
+++ b/Open-ILS/web/reports/xul/template_builder.xul
@@ -336,7 +336,7 @@
 </commandset>
 
 <popupset>
-	<popup id="source-menu" position="after_start"/>
+	<menupopup id="source-menu" position="after_start"/>
 	<popup
 		id="calendar-widget"
 		position="before_start"
diff --git a/Open-ILS/xul/staff_client/Makefile.am b/Open-ILS/xul/staff_client/Makefile.am
index bcd8bd3..9aea32e 100644
--- a/Open-ILS/xul/staff_client/Makefile.am
+++ b/Open-ILS/xul/staff_client/Makefile.am
@@ -9,10 +9,20 @@ export STAFF_CLIENT_STAMP_ID = $$(/bin/cat build/STAMP_ID)
 
 # from http://closure-compiler.googlecode.com/files/compiler-latest.zip  FIXME: Autotools this?
 export CLOSURE_COMPILER_JAR = ~/closure-compiler/compiler.jar
-XULRUNNER_VERSION=3.6.25
+
+# XULRunner is our base.
+XULRUNNER_VERSION=14.0.1
 XULRUNNER_WINFILE=xulrunner-$(XULRUNNER_VERSION).en-US.win32.zip
 XULRUNNER_LINUXFILE=xulrunner-$(XULRUNNER_VERSION).en-US.linux-i686.tar.bz2
 XULRUNNER_URL=ftp://ftp.mozilla.org/pub/mozilla.org/xulrunner/releases/$(XULRUNNER_VERSION)/runtimes/
+XULRUNNER_MAJOR_VERSION=$$(echo ${XULRUNNER_VERSION} | cut -d. -f1)
+
+# Extensions we include when not an extension ourselves
+# Grab the latest. If that becomes a problem we can swap them out for specific versions.
+DOMINSPECTOR_URL=https://addons.mozilla.org/firefox/downloads/latest/6622/addon-6622-latest.xpi
+DOMINSPECTOR_ID=inspector at mozilla.org
+VENKMAN_URL=https://addons.mozilla.org/firefox/downloads/latest/216/addon-216-latest.xpi
+VENKMAN_ID={f13b157f-b174-47e7-a34d-4815ddfdfeb8}
 
 OPENSRF_JSLIBS = "$(OPENSRF_LIBS)/javascript"
 CHROME_LOCALES = $$(ls -1 chrome/locale)
@@ -83,6 +93,7 @@ build_dir:
 	@cp -fR defaults build/
 	@cp -fR components build/
 	@cp application.ini build/
+	@cp chrome.manifest build/
 	@if [ -f "install.mccoy.rdf" ]; then cp install.mccoy.rdf build/install.rdf; else cp install.rdf build/; fi
 	@cp -fR build/chrome/content/util/ build/server/
 	@cp -fR build/chrome/content/auth/ build/server/
@@ -142,6 +153,7 @@ stamp:
 	@if [ -n "${STAFF_CLIENT_STAMP_ID}" ]; then find build/ -name '*.js' -exec sed -i -e s/xul\\\/server/xul\\\/${STAFF_CLIENT_STAMP_ID}\\\/server/g {} \; ; fi
 	@if [ -n "${STAFF_CLIENT_STAMP_ID}" ]; then find build/ -name '*.xml' -exec sed -i -e s/xul\\\/server/xul\\\/${STAFF_CLIENT_STAMP_ID}\\\/server/g {} \; ; fi
 	@if [ -n "${STAFF_CLIENT_STAMP_ID}" ]; then find build/ -name 'constants.js' -exec sed -i -e "s/\(CLIENT_STAMP *= '\)'/\1${STAFF_CLIENT_STAMP_ID}'/" {} \; ; fi
+	@if [ -n "${STAFF_CLIENT_NAME}" ]; then sed -i -e s/^Name=.\*/Name=${STAFF_CLIENT_NAME}/ build/application.ini ; fi
 	@if [ -z "${AUTOUPDATE_HOST}" ]; then rm -f build/defaults/preferences/autoupdate.js; fi
 	@if [ -z "${AUTOUPDATE_HOST}" ]; then sed -i -e /updateURL/d build/install.rdf; fi
 	@if [ -n "${AUTOUPDATE_HOST}" ]; then echo "Applying automatic update host ${AUTOUPDATE_HOST}"; fi
@@ -221,10 +233,33 @@ client_dir:
 client_app: client_dir
 	@echo 'Cleaning Extension Information'
 	@rm -f client/install.rdf
+	@echo 'Installing Extensions'
+	@mkdir -p client/extensions
+# Note: XULRunner before 4 requires extracted extensions
+# XULRunner after 4 keeps them in XPI form...unless their manifest says to unpack
+# This block is thus structured to make it easy to add the latter kind later.
+	@if [ ${XULRUNNER_MAJOR_VERSION} -lt 4 ]; then \
+		if [ -f extensions/${DOMINSPECTOR_ID}.xpi ]; then \
+			mkdir -p client/extensions/${DOMINSPECTOR_ID}/; \
+			unzip extensions/${DOMINSPECTOR_ID}.xpi -d client/extensions/${DOMINSPECTOR_ID}/; \
+		fi; \
+		if [ -f extensions/${VENKMAN_ID}.xpi ]; then \
+			mkdir -p client/extensions/${VENKMAN_ID}/; \
+			unzip extensions/${VENKMAN_ID}.xpi -d client/extensions/${VENKMAN_ID}/; \
+		fi; \
+	else \
+		if [ -f extensions/${DOMINSPECTOR_ID}.xpi ]; then \
+			cp extensions/${DOMINSPECTOR_ID}.xpi client/extensions/; \
+		fi; \
+		if [ -f extensions/${VENKMAN_ID}.xpi ]; then \
+			cp extensions/${VENKMAN_ID}.xpi client/extensions/; \
+		fi; \
+	fi
 
 # If automatic updates are enabled, or the standalone_xul_app.js is present,
 # the extension can break Firefox.
-# Remove those, and we need a chrome.manifest
+# Also, per machine registration + extension mode is probably a bad idea.
+# Remove those, and we need an updated chrome.manifest
 
 client_ext: client_dir
 	@echo 'Cleaning App Information'
@@ -232,8 +267,10 @@ client_ext: client_dir
 	@rm -f client/defaults/preferences/autoupdate.js
 	@rm -f client/defaults/preferences/autochannel.js
 	@rm -f client/defaults/preferences/standalone_xul_app.js
+	@rm -f client/defaults/preferences/aa_per_machine.js
 	@echo 'Prepping chrome.manifest'
 	@perl -ne 'if(/open_ils_staff_client/) { s/ (?!chrome:\/\/open_ils_staff_client)([^ ]*)$$/ chrome\/\1/; print; }' client/chrome/chrome.manifest > client/chrome.manifest
+	@grep -v manifest build/chrome.manifest >> client/chrome.manifest
 
 # Would merge client_ext into this one, but this way an installer that doesn't
 # use an xpi can be made for extension later, if desired
@@ -243,6 +280,21 @@ extension: client_ext
 	@(cd client/ && zip -q -r ../evergreen.xpi * -x defaults/preferences/standalone_xul_app.js)
 	@md5sum evergreen.xpi > evergreen.xpi.md5
 
+# Fetch extensions to load into the client
+# This could be done in a "if they aren't there" fashion, but these are manually triggered anyway
+# That, and this way you can update the extensions by running this target again
+fetch-extensions: fetch-dom-inspector fetch-venkman
+
+fetch-dom-inspector:
+	@echo 'Fetching DOM Inspector'
+	@mkdir -p extensions/
+	@wget -Oextensions/${DOMINSPECTOR_ID}.xpi ${DOMINSPECTOR_URL}
+
+fetch-venkman:
+	@echo 'Fetching Venkman'
+	@mkdir -p extensions/
+	@wget -Oextensions/${VENKMAN_ID}.xpi ${VENKMAN_URL}
+
 # Generic client, as an xpi, theoretically suitable for --install-app usage
 
 generic-client: client_app
@@ -276,14 +328,18 @@ win-xulrunner: unzip_check branding_check client_app
 	@if [ ! -f ${XULRUNNER_WINFILE} ]; then wget ${XULRUNNER_URL}${XULRUNNER_WINFILE}; fi
 	@unzip -q ${XULRUNNER_WINFILE} -dclient
 	@if [ -f client/defaults/preferences/autoupdate.js ]; then echo 'pref("app.update.channel","win");' >> client/defaults/preferences/autochannel.js; fi;
+	@if [ -d branding_win ]; then cp -fR branding_win/* client/; fi
 	@echo 'Preparing stub'
 	@if [ -f xulrunner-stub.exe ]; then cp xulrunner-stub.exe client/evergreen.exe; rm client/xulrunner/xulrunner-stub.exe; else mv client/xulrunner/xulrunner-stub.exe client/evergreen.exe; fi
+	@if [ ${XULRUNNER_MAJOR_VERSION} -ge 4 -a -f client/xulrunner/mozcrt19.dll ]; then cp client/xulrunner/mozcrt19.dll client/; fi # XULRunner 4+ need this, if the file exists
+	@if [ ${XULRUNNER_MAJOR_VERSION} -ge 9 -a -f client/xulrunner/mozutils.dll ]; then cp client/xulrunner/mozutils.dll client/; fi # XULRunner 9+ need this, if the file exists
 
 linux-xulrunner: client_app
 	@echo 'Preparing Linux xulrunner'
 	@if [ ! -f ${XULRUNNER_LINUXFILE} ]; then wget ${XULRUNNER_URL}${XULRUNNER_LINUXFILE}; fi
 	@cd client; tar xjf ../${XULRUNNER_LINUXFILE}; cd ..
 	@if [ -f client/defaults/preferences/autoupdate.js ]; then echo 'pref("app.update.channel","lin");' >> client/defaults/preferences/autochannel.js; fi;
+	@if [ -d branding_lin ]; then cp -fR branding_lin/* client/; fi
 	@echo 'Preparing stub'
 	@mv client/xulrunner/xulrunner-stub client/evergreen
 
diff --git a/Open-ILS/xul/staff_client/application.ini b/Open-ILS/xul/staff_client/application.ini
index 66f9a22..bc089f6 100644
--- a/Open-ILS/xul/staff_client/application.ini
+++ b/Open-ILS/xul/staff_client/application.ini
@@ -32,7 +32,7 @@ MinVersion=1.9
 ; application requires.  It should be specified if your application uses
 ; unfrozen interfaces.  Specifying 1.8 matches all releases with a version
 ; prefixed by 1.8 (e.g., 1.8a4, 1.8b, 1.8.2).
-MaxVersion=2.0
+MaxVersion=14.*
 
 [XRE]
 EnableExtensionManager=1
diff --git a/Open-ILS/xul/staff_client/chrome.manifest b/Open-ILS/xul/staff_client/chrome.manifest
new file mode 100644
index 0000000..bcb090c
--- /dev/null
+++ b/Open-ILS/xul/staff_client/chrome.manifest
@@ -0,0 +1,27 @@
+# Grab manifest from chrome directory
+manifest chrome/chrome.manifest
+# Grab xulrunner binary manifest
+manifest components/binary.manifest
+
+# Register our components
+#component {classID} components/file.js
+#contract @foobar/mycomponent;1 {classID}
+#category category-name MyComponent @foobar/mycomponent;1
+
+# Data Store Component
+component {dc3e4b5f-c0f4-4b34-bc57-7b4099c3a5d6} components/nsOpenILS.js
+contract @open-ils.org/openils_data_cache;1 {dc3e4b5f-c0f4-4b34-bc57-7b4099c3a5d6}
+
+# Command Line Handler
+component {7e608198-7355-483a-a85a-20322e4ef91a} components/clh.js
+contract @mozilla.org/commandlinehandler/general-startup;1?type=egcli {7e608198-7355-483a-a85a-20322e4ef91a}
+category command-line-handler m-egcli @mozilla.org/commandlinehandler/general-startup;1?type=egcli
+
+# Remote XUL Protocol (oils://)
+component {51d35450-5e59-11e1-b86c-0800200c9a66} components/oils_protocol.js
+contract @mozilla.org/network/protocol;1?name=oils {51d35450-5e59-11e1-b86c-0800200c9a66}
+
+# Force External
+component {D969ED61-DF4C-FA12-A2A6-70AA94C222FB} components/forceexternal.js
+contract @mozilla.org/content-policy;1?type=egfe {D969ED61-DF4C-FA12-A2A6-70AA94C222FB}
+category content-policy m-egfe @mozilla.org/content-policy;1?type=egfe
diff --git a/Open-ILS/xul/staff_client/chrome/chrome.manifest b/Open-ILS/xul/staff_client/chrome/chrome.manifest
index dff9b63..0a4f723 100644
--- a/Open-ILS/xul/staff_client/chrome/chrome.manifest
+++ b/Open-ILS/xul/staff_client/chrome/chrome.manifest
@@ -4,45 +4,3 @@ skin open_ils_staff_client open_ils_staff_client skin/
 locale branding en-US branding/locale/en-US/
 
 overlay chrome://browser/content/browser.xul chrome://open_ils_staff_client/content/firefox/overlay.xul
-
-style   chrome://global/content/customizeToolbar.xul    chrome://venkman/skin/venkman-overlay.css
-overlay chrome://messenger/content/messenger.xul        chrome://venkman/content/venkman-overlay.xul      application={3550f703-e582-4d05-9a08-453d09bdfdc6}
-overlay chrome://venkman/content/venkman-menus.xul      chrome://communicator/content/tasksOverlay.xul    application={92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
-overlay chrome://communicator/content/tasksOverlay.xul  chrome://venkman/content/venkman-overlay.xul      application={92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
-overlay chrome://calendar/content/calendar.xul          chrome://venkman/content/venkman-overlay.xul      application={718e30fb-e89b-41dd-9da7-e25a45638b28}
-overlay chrome://venkman/content/venkman.xul            chrome://communicator/content/utilityOverlay.xul  application={92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
-content venkman-ff         jar:venkman.jar!/content/venkman/ff/
-content venkman            jar:venkman.jar!/content/venkman/
-content venkman            jar:venkman.jar!/content/venkman/ contentaccessible=yes
-skin    venkman modern/1.0 jar:venkman.jar!/skin/modern/venkman/
-content venkman-sm         jar:venkman.jar!/content/venkman/sm/
-overlay chrome://browser/content/browser.xul            chrome://venkman/content/venkman-overlay.xul      application={ec8030f7-c20a-464f-9b0e-13a3a9e97384} application={a463f10c-3994-11da-9945-000d60ca027b}
-locale venkman en-US jar:venkman.jar!/locale/en-US/venkman/
-
-locale inspector de jar:inspector.jar!/locale/de/inspector/
-overlay chrome://inspector/content/inspector.xul chrome://communicator/content/utilityOverlay.xul application={92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
-locale inspector en-US jar:inspector.jar!/locale/en-US/inspector/
-overlay chrome://inspector/content/popupOverlay.xul chrome://inspector/content/viewers/dom/popupOverlay.xul
-overlay chrome://messenger/content/mailWindowOverlay.xul chrome://inspector/content/tasksOverlay-tb.xul application={3550f703-e582-4d05-9a08-453d09bdfdc6}
-overlay chrome://browser/content/macBrowserOverlay.xul chrome://inspector/content/tasksOverlay-ff.xul application={ec8030f7-c20a-464f-9b0e-13a3a9e97384}
-overlay chrome://communicator/content/tasksOverlay.xul chrome://inspector/content/tasksOverlay.xul application={92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
-overlay chrome://inspector/content/commandOverlay.xul chrome://inspector/content/viewers/styleRules/commandOverlay.xul
-overlay chrome://calendar/content/calendar.xul chrome://inspector/content/tasksOverlay-sb.xul application={718e30fb-e89b-41dd-9da7-e25a45638b28}
-overlay chrome://inspector/content/keysetOverlay.xul chrome://inspector/content/viewers/dom/keysetOverlay.xul
-skin inspector classic/1.0 jar:inspector.jar!/skin/classic/inspector/
-overlay chrome://browser/content/browser.xul chrome://inspector/content/tasksOverlay-ff.xul application={ec8030f7-c20a-464f-9b0e-13a3a9e97384}
-skin inspector modern/1.0 jar:inspector.jar!/skin/modern/inspector/
-locale inspector sk jar:inspector.jar!/locale/sk/inspector/
-overlay chrome://inspector/content/popupOverlay.xul chrome://inspector/content/viewers/styleRules/popupOverlay.xul
-overlay chrome://communicator/content/pref/preferences.xul chrome://inspector/content/prefs/prefsOverlay.xul application={92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
-content inspector jar:inspector.jar!/content/inspector/ xpcnativewrappers=no
-overlay chrome://inspector/content/commandOverlay.xul chrome://inspector/content/viewers/dom/commandOverlay.xul
-overlay chrome://inspector/content/inspector.xul chrome://browser/content/baseMenuOverlay.xul application={ec8030f7-c20a-464f-9b0e-13a3a9e97384}
-overlay chrome://inspector/content/inspector.xul chrome://communicator/content/tasksOverlay.xul application={92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
-
-content   chromelist                                jar:chrome_list.jar!/content/
-skin      chromelist       modern/1.0               jar:chrome_list.jar!/skin/
-locale    chromelist       en-US                    jar:chrome_list.jar!/locale/
-overlay   chrome://browser/content/browser.xul      chrome://chromelist/content/overlay/ChromeListOverlay.xul
-overlay   chrome://messenger/content/messenger.xul  chrome://chromelist/content/overlay/ChromeListOverlay.xul
-
diff --git a/Open-ILS/xul/staff_client/chrome/chrome_list.jar b/Open-ILS/xul/staff_client/chrome/chrome_list.jar
deleted file mode 100644
index 68deaa9..0000000
Binary files a/Open-ILS/xul/staff_client/chrome/chrome_list.jar and /dev/null differ
diff --git a/Open-ILS/xul/staff_client/chrome/content/OpenILS/data.js b/Open-ILS/xul/staff_client/chrome/content/OpenILS/data.js
index f31ab3e..fc17229 100644
--- a/Open-ILS/xul/staff_client/chrome/content/OpenILS/data.js
+++ b/Open-ILS/xul/staff_client/chrome/content/OpenILS/data.js
@@ -86,10 +86,8 @@ OpenILS.data.prototype = {
             obj.observers.add = function(full_path, func) {
                 try {
                     obj.error.sdump('D_OBSERVERS', 'entering observers.add\nfull_path = ' + full_path + '\nfunc = ' + func + '\n');
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-                    const OpenILS=new Components.Constructor("@mozilla.org/openils_data_cache;1", "nsIOpenILS");
-                    var data_cache=new OpenILS( );
-                    var stash = data_cache.wrappedJSObject.OpenILS.prototype.data;
+                    var data_cache = Components.classes["@open-ils.org/openils_data_cache;1"].getService();
+                    var stash = data_cache.wrappedJSObject.data;
 
                     var id = obj.observers.id++;
                     if (typeof obj.observers.cache[ full_path ] == 'undefined') obj.observers.cache[ full_path ] = {};
@@ -162,14 +160,12 @@ OpenILS.data.prototype = {
 
     'stash' : function () {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-            const OpenILS=new Components.Constructor("@mozilla.org/openils_data_cache;1", "nsIOpenILS");
-            var data_cache=new OpenILS( );
+            var data_cache = Components.classes["@open-ils.org/openils_data_cache;1"].getService();
             for (var i = 0; i < arguments.length; i++) {
                 try {
                     if (arguments[i] != 'hash' && arguments[i] != 'list') this.error.sdump('D_DATA_STASH','stashing ' + arguments[i] + ' : ' + this[arguments[i]] + (typeof this[arguments[i]] == 'object' ? ' = ' + (this[arguments[i]]) : '') + '\n');
                 } catch(F) { alert(F); }
-                data_cache.wrappedJSObject.OpenILS.prototype.data[arguments[i]] = this[arguments[i]];
+                data_cache.wrappedJSObject.data[arguments[i]] = this[arguments[i]];
             }
         } catch(E) {
             this.error.sdump('D_ERROR','Error in OpenILS.data.stash(): ' + js2JSON(E) );
@@ -216,10 +212,8 @@ OpenILS.data.prototype = {
 
     '_debug_stash' : function() {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-            const OpenILS=new Components.Constructor("@mozilla.org/openils_data_cache;1", "nsIOpenILS");
-            var data_cache=new OpenILS( );
-            for (var i in data_cache.wrappedJSObject.OpenILS.prototype.data) {
+            var data_cache = Components.classes["@open-ils.org/openils_data_cache;1"].getService();
+            for (var i in data_cache.wrappedJSObject.data) {
                 dump('_debug_stash ' + i + '\n');
             }
         } catch(E) {
@@ -246,10 +240,8 @@ OpenILS.data.prototype = {
 
     'stash_retrieve' : function() {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-            const OpenILS=new Components.Constructor("@mozilla.org/openils_data_cache;1", "nsIOpenILS");
-            var data_cache=new OpenILS( );
-            var dc = data_cache.wrappedJSObject.OpenILS.prototype.data;
+            var data_cache = Components.classes["@open-ils.org/openils_data_cache;1"].getService();
+            var dc = data_cache.wrappedJSObject.data;
             for (var i in dc) {
                 this.error.sdump('D_DATA_RETRIEVE','Retrieving ' + i + ' : ' + dc[i] + '\n');
                 this[i] = dc[i];
@@ -491,7 +483,6 @@ OpenILS.data.prototype = {
     },
 
     'network_retrieve' : function() {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var obj = this;
 
         JSAN.use('util.file'); var file = new util.file('global_font_adjust');
@@ -537,10 +528,8 @@ OpenILS.data.prototype = {
         function gen_fm_retrieval_func(classname,data) {
             var app = data[0]; var method = data[1]; var params = data[2]; var cacheable = data[3];
             return function () {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 
                 function convert() {
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     try {
                         if (obj.list[classname].constructor.name == 'Array') {
                             obj.hash[classname] = 
@@ -742,7 +731,6 @@ OpenILS.data.prototype = {
 
         this.chain.push(
             function() {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 var f = gen_fm_retrieval_func(
                     'my_asv',
                     [
@@ -753,7 +741,6 @@ OpenILS.data.prototype = {
                     ]
                 );
                 try {
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     f();
                 } catch(E) {
                     var error = 'Error: ' + js2JSON(E);
@@ -765,7 +752,6 @@ OpenILS.data.prototype = {
 
         this.chain.push(
             function() {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 var f = gen_fm_retrieval_func(
                     'asv',
                     [
@@ -776,7 +762,6 @@ OpenILS.data.prototype = {
                     ]
                 );
                 try {
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     f();
                 } catch(E) {
                     var error = 'Error: ' + js2JSON(E);
diff --git a/Open-ILS/xul/staff_client/chrome/content/OpenILS/global_util.js b/Open-ILS/xul/staff_client/chrome/content/OpenILS/global_util.js
index 6a85fdd..38e62ae 100644
--- a/Open-ILS/xul/staff_client/chrome/content/OpenILS/global_util.js
+++ b/Open-ILS/xul/staff_client/chrome/content/OpenILS/global_util.js
@@ -199,6 +199,15 @@
         }
     }
 
+    function oils_persist_hostname() {
+        if(location.protocol == 'oils:') {
+            JSAN.use('OpenILS.data'); var data = new OpenILS.data(); data.init({'via':'stash'});
+            return data.server_unadorned;
+        } else {
+            return location.hostname;
+        }
+    }
+
     function persist_helper(base_key_suffix) {
         try {
             if (base_key_suffix) {
@@ -220,7 +229,6 @@
             function gen_oils_persist_handler(bk,node) {
                 return function(ev) {
                     try {
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         var target;
                         if (ev.target.nodeName == 'command') {
                             target = node;
@@ -232,7 +240,7 @@
                             }
                         }
                         var filename = location.pathname.split('/')[ location.pathname.split('/').length - 1 ];
-                        var base_key = 'oils_persist_' + String(location.hostname + '_' + filename + '_' + target.getAttribute('id')).replace('/','_','g') + '_' + base_key_suffix;
+                        var base_key = 'oils_persist_' + String(oils_persist_hostname() + '_' + filename + '_' + target.getAttribute('id')).replace('/','_','g') + '_' + base_key_suffix;
                         var attribute_list = target.getAttribute('oils_persist').split(' ');
                         dump('on_oils_persist: <<< ' + target.nodeName + '.id = ' + target.id + '\t' + bk + '\n');
                         for (var j = 0; j < attribute_list.length; j++) {
@@ -282,12 +290,11 @@
                 };
             }
 
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var prefs = Components.classes['@mozilla.org/preferences-service;1'].getService(Components.interfaces['nsIPrefBranch']);
             var nodes = document.getElementsByAttribute('oils_persist','*');
             for (var i = 0; i < nodes.length; i++) {
                 var filename = location.pathname.split('/')[ location.pathname.split('/').length - 1 ];
-                var base_key = 'oils_persist_' + String(location.hostname + '_' + filename + '_' + nodes[i].getAttribute('id')).replace('/','_','g') + '_' + base_key_suffix;
+                var base_key = 'oils_persist_' + String(oils_persist_hostname() + '_' + filename + '_' + nodes[i].getAttribute('id')).replace('/','_','g') + '_' + base_key_suffix;
                 var attribute_list = nodes[i].getAttribute('oils_persist').split(' ');
                 dump('persist_helper: >>> ' + nodes[i].nodeName + '.id = ' + nodes[i].id + '\t' + base_key + '\n');
                 for (var j = 0; j < attribute_list.length; j++) {
@@ -417,7 +424,6 @@
 
     function get_contentWindow(frame) {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             if (frame && frame.contentWindow) {
                 try {
                     if (typeof frame.contentWindow.wrappedJSObject != 'undefined') {
@@ -575,7 +581,6 @@
 
     function copy_to_clipboard(ev) {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             var text;
             if (typeof ev == 'object') {
                 if (typeof ev.target != 'undefined') {
@@ -598,7 +603,6 @@
 
     function clear_the_cache() {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             var cacheClass         = Components.classes["@mozilla.org/network/cache-service;1"];
             var cacheService    = cacheClass.getService(Components.interfaces.nsICacheService);
             cacheService.evictEntries(Components.interfaces.nsICache.STORE_ON_DISK);
@@ -615,8 +619,14 @@
     }
 
     function url_prefix(url) {
+        var base_url = url.match(/^[^?/|]+/);
+        if(base_url) {
+            base_url = base_url[0];
+            if(urls[base_url])
+                url = url.replace(/^[^?/|]+\|/, urls[base_url]);
+        }
         if (url.match(/^\//)) url = urls.remote + url;
-        if (! url.match(/^(http|chrome):\/\//) && ! url.match(/^data:/) ) url = 'http://' + url;
+        if (! url.match(/^(http|https|chrome|oils):\/\//) && ! url.match(/^data:/) ) url = 'http://' + url;
         dump('url_prefix = ' + url + '\n');
         return url;
     }
diff --git a/Open-ILS/xul/staff_client/chrome/content/OpenILS/util_overlay_chrome.xul b/Open-ILS/xul/staff_client/chrome/content/OpenILS/util_overlay_chrome.xul
index c4b023b..c3b9e47 100644
--- a/Open-ILS/xul/staff_client/chrome/content/OpenILS/util_overlay_chrome.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/OpenILS/util_overlay_chrome.xul
@@ -38,10 +38,11 @@
                     dump('pulling in custom.js in util_overlay_chrome.xul\n');
                     // Pull in local customizations
                     var r = new XMLHttpRequest();
-                    r.open("GET", xulG.url_prefix('/xul/server/skin/custom.js'), false);
+                    var custom_js = xulG.url_prefix('CUSTOM_JS');
+                    r.open("GET", custom_js, false);
                     r.send(null);
                     if (r.status == 200) {
-                        dump('Evaluating /xul/server/skin/custom.js\n');
+                        dump('Evaluating ' + custom_js + '\n');
                         eval( r.responseText );
                     }
                 } else {
diff --git a/Open-ILS/xul/staff_client/chrome/content/OpenILS/util_overlay_offline.xul b/Open-ILS/xul/staff_client/chrome/content/OpenILS/util_overlay_offline.xul
index 5b50799..2b834db 100644
--- a/Open-ILS/xul/staff_client/chrome/content/OpenILS/util_overlay_offline.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/OpenILS/util_overlay_offline.xul
@@ -40,10 +40,11 @@
                     dump('pulling in custom.js in util_overlay_offline.xul\n');
                     // Pull in local customizations
                     var r = new XMLHttpRequest();
-                    r.open("GET", xulG.url_prefix('/xul/server/skin/custom.js'), false);
+                    var custom_js = xulG.url_prefix('CUSTOM_JS');
+                    r.open("GET", custom_js, false);
                     r.send(null);
                     if (r.status == 200) {
-                        dump('Evaluating /xul/server/skin/custom.js\n');
+                        dump('Evaluating ' + custom_js + '\n');
                         eval( r.responseText );
                     }
                 } else {
diff --git a/Open-ILS/xul/staff_client/chrome/content/admin/survey_wizard.xul b/Open-ILS/xul/staff_client/chrome/content/admin/survey_wizard.xul
index 95aacf8..6fe3dba 100644
--- a/Open-ILS/xul/staff_client/chrome/content/admin/survey_wizard.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/admin/survey_wizard.xul
@@ -26,7 +26,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( document.getElementById("offlineStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('..');
diff --git a/Open-ILS/xul/staff_client/chrome/content/auth/controller.js b/Open-ILS/xul/staff_client/chrome/content/auth/controller.js
index dd6de40..071fc66 100644
--- a/Open-ILS/xul/staff_client/chrome/content/auth/controller.js
+++ b/Open-ILS/xul/staff_client/chrome/content/auth/controller.js
@@ -196,7 +196,6 @@ auth.controller.prototype = {
                                             ws.name /*+ ' @  ' + ws.lib_shortname*/
                                         )
                                     );
-                                    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                                     JSAN.use('util.file'); var file = new util.file('last_ws_server');
                                     file.set_object(obj.controller.view.server_prompt.value);
                                     file.close();
@@ -284,7 +283,6 @@ auth.controller.prototype = {
     'test_server' : function(url) {
         var obj = this;
         if (!url) {
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             JSAN.use('util.file'); var file = new util.file('last_ws_server');
             if (file._file.exists()) {
                 url = file.get_object(); file.close();
@@ -554,9 +552,11 @@ auth.controller.prototype = {
         this.data.menu_perms = false;
         this.data.current_hotkeyset = undefined;
         this.data.enable_debug = this.data.debug_client;
+        this.data.session = undefined;
         this.data.stash('menu_perms');
         this.data.stash('current_hotkeyset');
         this.data.stash('enable_debug');
+        this.data.stash('session');
 
         /* FIXME - need some locking or object destruction for the async tests */
         /* this.test_server( this.controller.view.server_prompt.value ); */
diff --git a/Open-ILS/xul/staff_client/chrome/content/auth/session.js b/Open-ILS/xul/staff_client/chrome/content/auth/session.js
index 31843ee..880b4eb 100644
--- a/Open-ILS/xul/staff_client/chrome/content/auth/session.js
+++ b/Open-ILS/xul/staff_client/chrome/content/auth/session.js
@@ -158,9 +158,22 @@ auth.session.prototype = {
         var obj = this;
         obj.error.sdump('D_AUTH','auth.session.close()\n'); 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-            Components.classes["@mozilla.org/cookiemanager;1"]
-                .getService(Components.interfaces.nsICookieManager).removeAll();
+            // Remove *our* cookie(s), but leave any from elsewhere alone.
+            JSAN.use('OpenILS.data'); var data = new OpenILS.data(); data.stash_retrieve();
+            var host = data.server_unadorned;
+            host = host.toLowerCase();
+            var cookieManager = Components.classes["@mozilla.org/cookiemanager;1"]
+                .getService(Components.interfaces.nsICookieManager);
+            var iter = cookieManager.enumerator;
+            while (iter.hasMoreElements()) {
+                var cookie = iter.getNext();
+                if (cookie instanceof Components.interfaces.nsICookie) {
+                    var temphost = cookie.host.toLowerCase();
+                    if(temphost == host || temphost == '.' + host) {
+                        cookieManager.remove(cookie.host, cookie.name, cookie.path, cookie.blocked);
+                    }
+                }
+            }
         } catch(E) {
             dump('Error in auth/session.js, close(): ' + E + '\n');
         }
diff --git a/Open-ILS/xul/staff_client/chrome/content/cat/opac.js b/Open-ILS/xul/staff_client/chrome/content/cat/opac.js
index a2ce364..9f58b81 100644
--- a/Open-ILS/xul/staff_client/chrome/content/cat/opac.js
+++ b/Open-ILS/xul/staff_client/chrome/content/cat/opac.js
@@ -12,7 +12,6 @@ function $(id) { return document.getElementById(id); }
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw(document.getElementById('offlineStrings').getString('common.jsan.missing')); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('..');
@@ -24,10 +23,11 @@ function my_init() {
 
         // Pull in local customizations
         var r = new XMLHttpRequest();
-        r.open("GET", xulG.url_prefix('/xul/server/skin/custom.js'), false);
+        var custom_js = xulG.url_prefix('CUSTOM_JS');
+        r.open("GET", custom_js, false);
         r.send(null);
         if (r.status == 200) {
-            dump('Evaluating /xul/server/skin/custom.js\n');
+            dump('Evaluating ' + custom_js + '\n');
             eval( r.responseText );
         }
 
@@ -89,7 +89,7 @@ function opac_wrapper_set_help_context() {
 }
 
 function set_brief_view() {
-    var url = xulG.url_prefix( urls.XUL_BIB_BRIEF ) + '?docid=' + window.escape(docid); 
+    var url = xulG.url_prefix( 'XUL_BIB_BRIEF?docid=' ) + window.escape(docid); 
     dump('spawning ' + url + '\n');
 
     var content_params = {
@@ -119,10 +119,10 @@ function set_brief_view() {
 function set_marc_view() {
     g.view = 'marc_view';
     if (marc_view_reset) {
-        bottom_pane.reset_iframe( xulG.url_prefix( urls.XUL_MARC_VIEW ) + '?docid=' + window.escape(docid),{},xulG);
+        bottom_pane.reset_iframe( xulG.url_prefix( 'XUL_MARC_VIEW?docid=' ) + window.escape(docid),{},xulG);
         marc_view_reset = false;
     } else {
-        bottom_pane.set_iframe( xulG.url_prefix( urls.XUL_MARC_VIEW ) + '?docid=' + window.escape(docid),{},xulG);
+        bottom_pane.set_iframe( xulG.url_prefix( 'XUL_MARC_VIEW?docid=' ) + window.escape(docid),{},xulG);
     }
     opac_wrapper_set_help_context(); 
     bottom_pane.get_contentWindow().addEventListener('load',opac_wrapper_set_help_context,false);
@@ -130,7 +130,7 @@ function set_marc_view() {
 
 function set_marc_edit() {
     g.view = 'marc_edit';
-    var a =    xulG.url_prefix( urls.XUL_MARC_EDIT );
+    var a =    xulG.url_prefix( 'XUL_MARC_EDIT' );
     var b =    {};
     var c =    {
             'marc_control_number_identifier' : g.data.hash.aous['cat.marc_control_number_identifier'] || 'Set cat.marc_control_number_identifier in Library Settings',
@@ -222,7 +222,7 @@ function set_marc_edit() {
                             var unified_interface = String( data.hash.aous['ui.unified_volume_copy_editor'] ) == 'true';
                             if (unified_interface) {
                                 var horizontal_interface = String( data.hash.aous['ui.cat.volume_copy_editor.horizontal'] ) == 'true';
-                                var url = window.xulG.url_prefix( horizontal_interface ? urls.XUL_VOLUME_COPY_CREATOR_HORIZONTAL : urls.XUL_VOLUME_COPY_CREATOR );
+                                var url = window.xulG.url_prefix( horizontal_interface ? 'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : 'XUL_VOLUME_COPY_CREATOR' );
                                 var w = xulG.set_tab(
                                     url,
                                     {
@@ -292,10 +292,10 @@ function set_marc_edit() {
 function set_copy_browser() {
     g.view = 'copy_browser';
     if (copy_browser_reset) {
-        bottom_pane.reset_iframe( xulG.url_prefix( urls.XUL_COPY_VOLUME_BROWSE ) + '?docid=' + window.escape(docid),{},xulG);
+        bottom_pane.reset_iframe( xulG.url_prefix( 'XUL_COPY_VOLUME_BROWSE?docid=' ) + window.escape(docid),{},xulG);
         copy_browser_reset =false;
     } else {
-        bottom_pane.set_iframe( xulG.url_prefix( urls.XUL_COPY_VOLUME_BROWSE ) + '?docid=' + window.escape(docid),{},xulG);
+        bottom_pane.set_iframe( xulG.url_prefix( 'XUL_COPY_VOLUME_BROWSE?docid=' ) + window.escape(docid),{},xulG);
     }
     opac_wrapper_set_help_context(); 
     bottom_pane.get_contentWindow().addEventListener('load',opac_wrapper_set_help_context,false);
@@ -304,10 +304,10 @@ function set_copy_browser() {
 function set_hold_browser() {
     g.view = 'hold_browser';
     if (hold_browser_reset) {
-        bottom_pane.reset_iframe( xulG.url_prefix( urls.XUL_HOLDS_BROWSER ) + '?docid=' + window.escape(docid),{},xulG);
+        bottom_pane.reset_iframe( xulG.url_prefix( 'XUL_HOLDS_BROWSER?docid=' ) + window.escape(docid),{},xulG);
         hold_browser_reset = false;
     } else {
-        bottom_pane.set_iframe( xulG.url_prefix( urls.XUL_HOLDS_BROWSER ) + '?docid=' + window.escape(docid),{},xulG);
+        bottom_pane.set_iframe( xulG.url_prefix( 'XUL_HOLDS_BROWSER?docid=' ) + window.escape(docid),{},xulG);
     }
     opac_wrapper_set_help_context(); 
     bottom_pane.get_contentWindow().addEventListener('load',opac_wrapper_set_help_context,false);
@@ -333,7 +333,7 @@ function open_acq_orders() {
         ].forEach(function(k) { content_params[k] = xulG[k]; });
 
         var loc = urls.XUL_BROWSER + "?url=" + window.escape(
-            xulG.url_prefix("/eg/acq/lineitem/related/") +
+            xulG.url_prefix("ACQ_LINEITEM") +
             docid + "?target=bib"
         );
         xulG.new_tab(
@@ -371,7 +371,7 @@ function open_alt_serial_mgmt() {
         ].forEach(function(k) { content_params[k] = xulG[k]; });
 
         var loc = urls.XUL_BROWSER + "?url=" + window.escape(
-            xulG.url_prefix("/eg/serial/list_subscription?record_entry=") +
+            xulG.url_prefix("SERIAL_LIST_SUBSCRIPTION?record_entry=") +
             docid
         );
         xulG.new_tab(
@@ -398,7 +398,6 @@ function set_opac() {
                 'authtime' : ses('authtime'),
                 'window_open' : function(a,b,c) {
                     try {
-                        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                         return window.open(a,b,c);
                     } catch(E) {
                         g.error.standard_unexpected_error_alert('window_open',E);
@@ -441,7 +440,6 @@ function set_opac() {
                 }
             },
             'on_url_load' : function(f) {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 var win;
                 try {
                     if (typeof f.contentWindow.wrappedJSObject.attachEvt != 'undefined') {
@@ -607,7 +605,6 @@ function set_opac() {
         content_params.get_barcode_and_settings = xulG.get_barcode_and_settings;
 
         var secure_opac = true; // default to secure
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var prefs = Components.classes['@mozilla.org/preferences-service;1'].getService(Components.interfaces['nsIPrefBranch']);
         if (prefs.prefHasUserValue('oils.secure_opac')) {
             secure_opac = prefs.getBoolPref('oils.secure_opac');
@@ -617,11 +614,11 @@ function set_opac() {
         if (opac_url) {
             content_params.url = xulG.url_prefix( opac_url, secure_opac );
         } else {
-            content_params.url = xulG.url_prefix( urls.browser, secure_opac );
+            content_params.url = xulG.url_prefix( 'browser', secure_opac );
         }
-        browser_frame = bottom_pane.set_iframe( xulG.url_prefix(urls.XUL_BROWSER) + '?name=Catalog', {}, content_params);
+        browser_frame = bottom_pane.set_iframe( xulG.url_prefix('XUL_BROWSER?name=Catalog'), {}, content_params);
         /* // Remember to use the REMOTE_BROWSER if we ever try to move this to remote xul again
-        browser_frame = bottom_pane.set_iframe( xulG.url_prefix(urls.XUL_REMOTE_BROWSER) + '?name=Catalog', {}, content_params);
+        browser_frame = bottom_pane.set_iframe( xulG.url_prefix('XUL_REMOTE_BROWSER?name=Catalog'), {}, content_params);
         */
     } catch(E) {
         g.error.sdump('D_ERROR','set_opac: ' + E);
@@ -643,10 +640,10 @@ xulG.reload_opac = function() {
 function set_serctrl_view() {
     g.view = 'serctrl_view';
     if (serctrl_view_reset) {
-        bottom_pane.reset_iframe( xulG.url_prefix( urls.XUL_SERIAL_SERCTRL_MAIN ) + '?docid=' + window.escape(docid), {}, xulG);
+        bottom_pane.reset_iframe( xulG.url_prefix( 'XUL_SERIAL_SERCTRL_MAIN?docid=' ) + window.escape(docid), {}, xulG);
         serctrl_view_reset =false;
     } else {
-        bottom_pane.set_iframe( xulG.url_prefix( urls.XUL_SERIAL_SERCTRL_MAIN ) + '?docid=' + window.escape(docid), {}, xulG);
+        bottom_pane.set_iframe( xulG.url_prefix( 'XUL_SERIAL_SERCTRL_MAIN?docid=' ) + window.escape(docid), {}, xulG);
     }
 }
 
@@ -680,7 +677,7 @@ function create_mfhd() {
     try {
         JSAN.use('util.window'); var win = new util.window();
         var select_aou_window = win.open(
-            xulG.url_prefix(urls.XUL_SERIAL_SELECT_AOU),
+            xulG.url_prefix('XUL_SERIAL_SELECT_AOU'),
             '_blank',
             'chrome,resizable,modal,centerscreen',
             {'server_unadorned' : g.data.server_unadorned}
@@ -739,7 +736,7 @@ function open_mfhd_editor(sre_id) {
 }
 
 function open_marc_editor(rec, label) {
-    win = window.open( xulG.url_prefix('/xul/server/cat/marcedit.xul') );
+    win = window.open( xulG.url_prefix('XUL_MARC_EDIT') );
 
     win.xulG = {
         record : {marc : rec.marc()},
@@ -785,7 +782,7 @@ function bib_in_new_tab() {
         content_params.get_barcode = xulG.get_barcode;
         content_params.get_barcode_and_settings = xulG.get_barcode_and_settings;
 
-        xulG.new_tab(xulG.url_prefix(urls.XUL_OPAC_WRAPPER), {}, content_params);
+        xulG.new_tab(xulG.url_prefix('XUL_OPAC_WRAPPER'), {}, content_params);
     } catch(E) {
         g.error.sdump('D_ERROR',E);
     }
@@ -804,8 +801,8 @@ function batch_receive_in_new_tab() {
         ].forEach(function(k) { content_params[k] = xulG[k]; });
 
         xulG.new_tab(
-            xulG.url_prefix(urls.XUL_SERIAL_BATCH_RECEIVE) +
-                "?docid=" + window.escape(docid), {
+            xulG.url_prefix('XUL_SERIAL_BATCH_RECEIVE?docid=') +
+                window.escape(docid), {
                 "tab_name": $("offlineStrings").getString(
                     "menu.cmd_serial_batch_receive.tab"
                 )
@@ -817,7 +814,7 @@ function batch_receive_in_new_tab() {
 }
 
 function remove_me() {
-    var url = xulG.url_prefix( urls.XUL_BIB_BRIEF ) + '?docid=' + window.escape(docid);
+    var url = xulG.url_prefix( 'XUL_BIB_BRIEF?docid=' ) + window.escape(docid);
     dump('removing ' + url + '\n');
     try { top_pane.remove_iframe( url ); } catch(E) { dump(E + '\n'); }
     $('nav').setAttribute('hidden','true');
@@ -826,7 +823,7 @@ function remove_me() {
 function add_to_bucket() {
     JSAN.use('util.window'); var win = new util.window();
     win.open(
-        xulG.url_prefix(urls.XUL_RECORD_BUCKETS_QUICK),
+        xulG.url_prefix('XUL_RECORD_BUCKETS_QUICK'),
         '_blank',
         'chrome,resizable,modal,centerscreen',
         {
@@ -1062,9 +1059,9 @@ function add_volumes() {
         var unified_interface = String( g.data.hash.aous['ui.unified_volume_copy_editor'] ) == 'true';
         if (unified_interface) {
             var horizontal_interface = String( g.data.hash.aous['ui.cat.volume_copy_editor.horizontal'] ) == 'true';
-            url = window.xulG.url_prefix( horizontal_interface ? urls.XUL_VOLUME_COPY_CREATOR_HORIZONTAL : urls.XUL_VOLUME_COPY_CREATOR );
+            url = window.xulG.url_prefix( horizontal_interface ? 'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : 'XUL_VOLUME_COPY_CREATOR' );
         } else {
-            url = window.xulG.url_prefix( urls.XUL_VOLUME_COPY_CREATOR_ORIGINAL );
+            url = window.xulG.url_prefix( 'XUL_VOLUME_COPY_CREATOR_ORIGINAL' );
         }
 
         var w = xulG.new_tab(
@@ -1081,7 +1078,7 @@ function manage_parts() {
     try {
         g.view = 'manage_parts';
         var loc = urls.XUL_BROWSER + "?url=" + window.escape(
-            window.xulG.url_prefix(urls.CONIFY_MANAGE_PARTS) + '?r=' + docid
+            window.xulG.url_prefix('CONIFY_MANAGE_PARTS?r=') + docid
         );
         if (manage_parts_reset) {
             bottom_pane.reset_iframe( loc,{},xulG);
@@ -1099,7 +1096,7 @@ function manage_parts() {
 function manage_multi_home_items() {
     try {
         g.view = 'manage_multi_home';
-        var loc = window.xulG.url_prefix(urls.MANAGE_MULTI_HOME_ITEMS);
+        var loc = window.xulG.url_prefix('MANAGE_MULTI_HOME_ITEMS');
         if (manage_multi_home_reset) {
             bottom_pane.reset_iframe( loc,{},{'docid':docid,'no_bib_summary':true,'url_prefix':xulG.url_prefix,'new_tab':xulG.new_tab});
             manage_multi_home_reset =false;
@@ -1152,14 +1149,14 @@ function gen_statusbar_click_handler(data_key) {
         }
 
         if (ev.button == 0 /* left click, spawn opac */) {
-            var opac_url = xulG.url_prefix( urls.opac_rdetail ) + g.data[data_key];
+            var opac_url = xulG.url_prefix( 'opac_rdetail' ) + g.data[data_key];
             var content_params = {
                 'session' : ses(),
                 'authtime' : ses('authtime'),
                 'opac_url' : opac_url,
             };
             xulG.new_tab(
-                xulG.url_prefix(urls.XUL_OPAC_WRAPPER),
+                xulG.url_prefix('XUL_OPAC_WRAPPER'),
                 {'tab_name':'Retrieving title...'},
                 content_params
             );
diff --git a/Open-ILS/xul/staff_client/chrome/content/cat/opac.xul b/Open-ILS/xul/staff_client/chrome/content/cat/opac.xul
index 0c97436..ab15bc3 100644
--- a/Open-ILS/xul/staff_client/chrome/content/cat/opac.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/cat/opac.xul
@@ -23,7 +23,6 @@
     <!-- BEHAVIOR -->
         <script type="text/javascript">
         var myPackageDir = 'open_ils_staff_client'; var IAMXUL = true; var g = {};
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     </script>
         <scripts id="openils_util_scripts"/>
 <script type="text/javascript" src="chrome://openils_staff_client/content/OpenILS/util/fmall.js"/>
diff --git a/Open-ILS/xul/staff_client/chrome/content/circ/offline.js b/Open-ILS/xul/staff_client/chrome/content/circ/offline.js
index d3cc499..225fadf 100644
--- a/Open-ILS/xul/staff_client/chrome/content/circ/offline.js
+++ b/Open-ILS/xul/staff_client/chrome/content/circ/offline.js
@@ -3,7 +3,6 @@ dump('entering circ.offline.js\n');
 if (typeof circ == 'undefined') circ = {};
 circ.offline = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
     } catch(E) {
         dump('circ.offline: ' + E + '\n');
@@ -15,8 +14,6 @@ circ.offline.prototype = {
     'init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
             var obj = this;
 
             JSAN.use('util.deck'); obj.deck = new util.deck('main');
diff --git a/Open-ILS/xul/staff_client/chrome/content/circ/offline.xul b/Open-ILS/xul/staff_client/chrome/content/circ/offline.xul
index 4b94d7a..dbd9111 100644
--- a/Open-ILS/xul/staff_client/chrome/content/circ/offline.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/circ/offline.xul
@@ -37,7 +37,6 @@
             try {
                 offlineStrings = document.getElementById('offlineStrings');
 
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         if (typeof JSAN == 'undefined') { throw(offlineStrings.getString('common.jsan.missing')); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('..');
diff --git a/Open-ILS/xul/staff_client/chrome/content/circ/offline_checkin.js b/Open-ILS/xul/staff_client/chrome/content/circ/offline_checkin.js
index e764878..31e5bbe 100644
--- a/Open-ILS/xul/staff_client/chrome/content/circ/offline_checkin.js
+++ b/Open-ILS/xul/staff_client/chrome/content/circ/offline_checkin.js
@@ -5,7 +5,6 @@ function my_init() {
     try {
         offlineStrings = $('offlineStrings');
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw(offlineStrings.getString('common.jsan.missing')); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('..');
@@ -28,7 +27,6 @@ function my_init() {
         JSAN.use('util.date');
 
         function handle_lock(ev) {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (!(ev.altKey || ev.ctrlKey || ev.metakey)) {
                 if (!local_lock) {
                     local_lock = true;
diff --git a/Open-ILS/xul/staff_client/chrome/content/circ/offline_checkout.js b/Open-ILS/xul/staff_client/chrome/content/circ/offline_checkout.js
index 99da750..3190b3a 100644
--- a/Open-ILS/xul/staff_client/chrome/content/circ/offline_checkout.js
+++ b/Open-ILS/xul/staff_client/chrome/content/circ/offline_checkout.js
@@ -5,7 +5,6 @@ function my_init() {
     try {
         offlineStrings = $('offlineStrings');
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw(offlineStrings.getString('common.jsan.missing')); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('..');
@@ -33,7 +32,6 @@ function my_init() {
         todayPlus = util.date.formatted_date(todayPlus,"%F");
 
         function handle_lock(ev) {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (!(ev.altKey || ev.ctrlKey || ev.metakey)) {
                 if (!local_lock) {
                     local_lock = true;
diff --git a/Open-ILS/xul/staff_client/chrome/content/circ/offline_in_house_use.js b/Open-ILS/xul/staff_client/chrome/content/circ/offline_in_house_use.js
index f849b4e..4004fd9 100644
--- a/Open-ILS/xul/staff_client/chrome/content/circ/offline_in_house_use.js
+++ b/Open-ILS/xul/staff_client/chrome/content/circ/offline_in_house_use.js
@@ -5,7 +5,6 @@ function my_init() {
     try {
         offlineStrings = document.getElementById('offlineStrings');
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw(offlineStrings.getString('common.jsan.missing')); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('..');
@@ -26,7 +25,6 @@ function my_init() {
         } );
 
         function handle_lock(ev) {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (!(ev.altKey || ev.ctrlKey || ev.metakey)) {
                 if (!local_lock) {
                     local_lock = true;
diff --git a/Open-ILS/xul/staff_client/chrome/content/circ/offline_register.js b/Open-ILS/xul/staff_client/chrome/content/circ/offline_register.js
index f3e31c1..fe16aef 100644
--- a/Open-ILS/xul/staff_client/chrome/content/circ/offline_register.js
+++ b/Open-ILS/xul/staff_client/chrome/content/circ/offline_register.js
@@ -5,7 +5,6 @@ function my_init() {
     try {
         offlineStrings = $('offlineStrings');
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw(offlineStrings.getString('common.jsan.missing')); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('..');
@@ -23,7 +22,6 @@ function my_init() {
         $('submit').addEventListener('command',next_patron,false);
 
         function handle_lock(ev) {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (!(ev.altKey || ev.ctrlKey || ev.metakey)) {
                 if (!local_lock) {
                     local_lock = true;
diff --git a/Open-ILS/xul/staff_client/chrome/content/circ/offline_renew.js b/Open-ILS/xul/staff_client/chrome/content/circ/offline_renew.js
index d04cc5a..780b3b1 100644
--- a/Open-ILS/xul/staff_client/chrome/content/circ/offline_renew.js
+++ b/Open-ILS/xul/staff_client/chrome/content/circ/offline_renew.js
@@ -4,7 +4,6 @@ var local_lock = false;
 function my_init() {
     try {
         offlineStrings = $('offlineStrings');
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('..');
@@ -30,7 +29,6 @@ function my_init() {
         todayPlus = util.date.formatted_date(todayPlus,"%F");
 
         function handle_lock(ev) {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (!(ev.altKey || ev.ctrlKey || ev.metakey)) {
                 if (!local_lock) {
                     local_lock = true;
diff --git a/Open-ILS/xul/staff_client/chrome/content/firefox/overlay.xul b/Open-ILS/xul/staff_client/chrome/content/firefox/overlay.xul
index cbe6988..544e6ba 100644
--- a/Open-ILS/xul/staff_client/chrome/content/firefox/overlay.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/firefox/overlay.xul
@@ -1,19 +1,18 @@
 <?xml version="1.0"?>
-<overlay id="sample" 
+<overlay id="eg_firefox_browser" 
          xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-<!--
- <statusbar id="status-bar">
-  <statusbarpanel id="my-panel" label="Hello, World"  />
- </statusbar>
--->
   <menupopup id="menu_ToolsPopup">
-    <menuitem id="evergreen_entry" insertbefore="devToolsSeparator" label="Evergreen Client"
-        oncommand="try {
-          Components.classes['@mozilla.org/embedcomp/window-watcher;1']
-                    .getService(Components.interfaces.nsIWindowWatcher)
-                    .openWindow(null, 'chrome://open_ils_staff_client/content/main/main.xul', '_blank',
-                                'chrome,dialog=no,all', null);
-            } catch(E) { alert(E); }
-        "/>
+    <menuitem id="evergreen_entry_tools" insertbefore="devToolsSeparator" label="Evergreen Client"
+      oncommand="try {
+          Components.classes['@open-ils.org/openils_data_cache;1'].getService().wrappedJSObject.openMainEGWindow();
+        } catch(E) { alert(E); }
+      "/>
   </menupopup>
+  <vbox id="appmenuPrimaryPane">
+    <menuitem id="evergreen_entry_primary" insertafter="appmenu_webDeveloper" label="Evergreen Client"
+      oncommand="try {
+          Components.classes['@open-ils.org/openils_data_cache;1'].getService().wrappedJSObject.openMainEGWindow();
+        } catch(E) { alert(E); }
+      "/>
+  </vbox>
 </overlay>
diff --git a/Open-ILS/xul/staff_client/chrome/content/main/constants.js b/Open-ILS/xul/staff_client/chrome/content/main/constants.js
index 870f430..70041d6 100644
--- a/Open-ILS/xul/staff_client/chrome/content/main/constants.js
+++ b/Open-ILS/xul/staff_client/chrome/content/main/constants.js
@@ -4,16 +4,15 @@ dump('Loading constants.js\n');
 
     urls['AUDIO_good'] = '/xul/server/skin/media/custom/good.wav';
 
-    urls['opac'] = '/opac/' + LOCALE + '/skin/mylib/xml/advanced.xml?nps=1';
-    urls['opac_rdetail'] = '/opac/' + LOCALE + '/skin/mylib/xml/rdetail.xml';
-    urls['opac_rresult'] = '/opac/' + LOCALE + '/skin/mylib/xml/rresult.xml';
-    urls['browser'] = '/opac/' + LOCALE + '/skin/mylib/xml/advanced.xml?nps=1';
+    urls['opac'] = 'oils://remote/opac/' + LOCALE + '/skin/mylib/xml/advanced.xml?nps=1';
+    urls['opac_rdetail'] = 'oils://remote/opac/' + LOCALE + '/skin/mylib/xml/rdetail.xml';
+    urls['opac_rresult'] = 'oils://remote/opac/' + LOCALE + '/skin/mylib/xml/rresult.xml';
+    urls['browser'] = 'oils://remote/opac/' + LOCALE + '/skin/mylib/xml/advanced.xml?nps=1';
 
 */
 
 /* Get locale from preferences */
 var LOCALE = '';
-netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 var pref = Components.classes["@mozilla.org/preferences-service;1"].getService(Components.interfaces.nsIPrefBranch);
 try {
     LOCALE = pref.getCharPref('general.useragent.locale');
@@ -380,17 +379,17 @@ var api = {
 
 var urls = {
 
-    'opac' : '/opac/' + LOCALE + '/skin/default/xml/advanced.xml?nps=1',
-    'opac_rdetail' : '/opac/' + LOCALE + '/skin/default/xml/rdetail.xml?r=',
-    'opac_rresult' : '/opac/' + LOCALE + '/skin/default/xml/rresult.xml',
-    'opac_rresult_metarecord' : '/opac/' + LOCALE + '/skin/default/xml/rresult.xml?m=',
+    'opac' : 'oils://remote/opac/' + LOCALE + '/skin/default/xml/advanced.xml?nps=1',
+    'opac_rdetail' : 'oils://remote/opac/' + LOCALE + '/skin/default/xml/rdetail.xml?r=',
+    'opac_rresult' : 'oils://remote/opac/' + LOCALE + '/skin/default/xml/rresult.xml',
+    'opac_rresult_metarecord' : 'oils://remote/opac/' + LOCALE + '/skin/default/xml/rresult.xml?m=',
     'org_tree' : '/opac/common/js/' + LOCALE + '/OrgTree.js',
-    'browser' : '/opac/' + LOCALE + '/skin/default/xml/advanced.xml?nps=1',
+    'browser' : 'oils://remote/opac/' + LOCALE + '/skin/default/xml/advanced.xml?nps=1',
     'fieldmapper' : '/opac/common/js/fmall.js',
     'xsl_marc2html' : '/opac/extras/xsl/oilsMARC21slim2HTML.xsl',
     'ac_jacket_small' : '/opac/extras/ac/jacket/small/',
     'ac_jacket_large' : '/opac/extras/ac/jacket/large/',
-    'MARC_BATCH_EDIT' : '/opac/extras/merge_template/',
+    'MARC_BATCH_EDIT' : 'oils://remote/opac/extras/merge_template/',
 
     'AUDIO_good' : '/xul/server/skin/media/audio/bonus.wav',
     'AUDIO_bad' : '/xul/server/skin/media/audio/question.wav',
@@ -400,126 +399,137 @@ var urls = {
     'AUDIO_event_ASSET_COPY_NOT_FOUND' : '/xul/server/skin/media/audio/redalert.wav',
 
     'AUTHORITY_MANAGE' : '/eg/cat/authority/list',
-    'MANAGE_MULTI_HOME_ITEMS' : '/xul/server/cat/manage_multi_home_items.xul',
-    'XUL_AUTH_SIMPLE' : '/xul/server/main/simple_auth.xul',
-    'XUL_BIB_BRIEF' : '/xul/server/cat/bib_brief.xul',
-    'XUL_BIB_BRIEF_VERTICAL' : '/xul/server/cat/bib_brief_vertical.xul',
+    'MANAGE_MULTI_HOME_ITEMS' : 'oils://remote/xul/server/cat/manage_multi_home_items.xul',
+    'XUL_AUTH_SIMPLE' : 'oils://remote/xul/server/main/simple_auth.xul',
+    'XUL_BIB_BRIEF' : 'oils://remote/xul/server/cat/bib_brief.xul',
+    'XUL_BIB_BRIEF_VERTICAL' : 'oils://remote/xul/server/cat/bib_brief_vertical.xul',
     'XUL_BROWSER' : 'chrome://open_ils_staff_client/content/util/browser.xul',
-    'XUL_CHECKIN' : '/xul/server/circ/checkin.xul',
-    'XUL_BACKDATE' : '/xul/server/circ/backdate_post_checkin.xul',
-    'XUL_RENEW' : '/xul/server/circ/renew.xul',
-    'XUL_CHECKOUT' : '/xul/server/circ/checkout.xul',
-    'XUL_CIRC_BRIEF' : '/xul/server/circ/circ_brief.xul',
-    'XUL_CIRC_SUMMARY' : '/xul/server/circ/circ_summary.xul',
-    'XUL_COPY_BUCKETS_QUICK' : '/xul/server/cat/copy_buckets_quick.xul',
-    'XUL_COPY_BUCKETS' : '/xul/server/cat/copy_buckets.xul',
-    'XUL_COPY_DETAILS' : '/xul/server/circ/copy_details.xul',
-    'XUL_COPY_EDITOR' : '/xul/server/cat/copy_editor.xul',
-    'XUL_COPY_LOCATION_EDIT' : '/xul/server/admin/copy_locations.xhtml',
-    'XUL_COPY_NOTES' : '/xul/server/cat/copy_notes.xul',
-    'XUL_COPY_STATUS' : '/xul/server/circ/copy_status.xul',
-    'XUL_COPY_SUMMARY' : '/xul/server/cat/copy_summary.xul',
-    'XUL_COPY_VOLUME_BROWSE' : '/xul/server/cat/copy_browser.xul',
+    'XUL_CHECKIN' : 'oils://remote/xul/server/circ/checkin.xul',
+    'XUL_BACKDATE' : 'oils://remote/xul/server/circ/backdate_post_checkin.xul',
+    'XUL_RENEW' : 'oils://remote/xul/server/circ/renew.xul',
+    'XUL_CHECKOUT' : 'oils://remote/xul/server/circ/checkout.xul',
+    'XUL_CIRC_BRIEF' : 'oils://remote/xul/server/circ/circ_brief.xul',
+    'XUL_CIRC_SUMMARY' : 'oils://remote/xul/server/circ/circ_summary.xul',
+    'XUL_COPY_BUCKETS_QUICK' : 'oils://remote/xul/server/cat/copy_buckets_quick.xul',
+    'XUL_COPY_BUCKETS' : 'oils://remote/xul/server/cat/copy_buckets.xul',
+    'XUL_COPY_DETAILS' : 'oils://remote/xul/server/circ/copy_details.xul',
+    'XUL_COPY_EDITOR' : 'oils://remote/xul/server/cat/copy_editor.xul',
+    'XUL_COPY_LOCATION_EDIT' : 'oils://remote/xul/server/admin/copy_locations.xhtml',
+    'XUL_COPY_NOTES' : 'oils://remote/xul/server/cat/copy_notes.xul',
+    'XUL_COPY_STATUS' : 'oils://remote/xul/server/circ/copy_status.xul',
+    'XUL_COPY_SUMMARY' : 'oils://remote/xul/server/cat/copy_summary.xul',
+    'XUL_COPY_VOLUME_BROWSE' : 'oils://remote/xul/server/cat/copy_browser.xul',
     'XUL_DEBUG_CONSOLE' : 'chrome://global/content/console.xul',
-    'XUL_DEBUG_FIELDMAPPER' : '/xul/server/util/fm_view.xul',
-    'XUL_DEBUG_FILTER_CONSOLE' : '/xul/server/util/filter_console.xul',
-    'XUL_DEBUG_SHELL' : '/xul/server/util/shell.html',
-    'XUL_DEBUG_XULEDITOR' : '/xul/server/util/xuledit.xul',
-    'XUL_DO_NOT_AUTO_ATTEMPT_PRINT_SETTING' : '/xul/server/admin/do_not_auto_attempt_print_setting.xul',
-    'XUL_FANCY_PROMPT' : '/xul/server/util/fancy_prompt.xul',
-    'XUL_HOLD_CAPTURE' : '/xul/server/circ/hold_capture.xul',
-    /*'XUL_HOLD_PULL_LIST' : '/xul/server/admin/hold_pull_list.xhtml',*/
-    'XUL_HOLD_PULL_LIST' : '/xul/server/patron/holds.xul',
-    'XUL_HOLDS_BROWSER' : '/xul/server/patron/holds.xul',
-    'XUL_HOLD_DETAILS' : '/xul/server/patron/hold_details.xul',
-    'XUL_HOLD_CANCEL' : '/xul/server/patron/hold_cancel.xul',
-    'XUL_HOLD_PLACEMENT' : '/xul/server/patron/place_hold.xul',
-    'XUL_IN_HOUSE_USE' : '/xul/server/circ/in_house_use.xul',
-    'XUL_LIST_CLIPBOARD' : '/xul/server/util/list_clipboard.xul',
-    'XUL_LOCAL_ADMIN' : '/xul/server/admin/index.xhtml',
-    'XUL_LOGIN_DATA' : '/xul/server/main/data.xul', 
-    'XUL_MARC_NEW' : '/xul/server/cat/marc_new.xul',
-    'XUL_MARC_EDIT' : '/xul/server/cat/marcedit.xul',
-    'XUL_MARC_VIEW' : '/xul/server/cat/marc_view.xul',
+    'XUL_DEBUG_FIELDMAPPER' : 'oils://remote/xul/server/util/fm_view.xul',
+    'XUL_DEBUG_FILTER_CONSOLE' : 'oils://remote/xul/server/util/filter_console.xul',
+    'XUL_DEBUG_SHELL' : 'oils://remote/xul/server/util/shell.html',
+    'XUL_DEBUG_XULEDITOR' : 'oils://remote/xul/server/util/xuledit.xul',
+    'XUL_DO_NOT_AUTO_ATTEMPT_PRINT_SETTING' : 'oils://remote/xul/server/admin/do_not_auto_attempt_print_setting.xul',
+    'XUL_FANCY_PROMPT' : 'oils://remote/xul/server/util/fancy_prompt.xul',
+    'XUL_HOLD_CAPTURE' : 'oils://remote/xul/server/circ/hold_capture.xul',
+    /*'XUL_HOLD_PULL_LIST' : 'oils://remote/xul/server/admin/hold_pull_list.xhtml',*/
+    'XUL_HOLD_PULL_LIST' : 'oils://remote/xul/server/patron/holds.xul',
+    'XUL_HOLDS_BROWSER' : 'oils://remote/xul/server/patron/holds.xul',
+    'XUL_HOLD_DETAILS' : 'oils://remote/xul/server/patron/hold_details.xul',
+    'XUL_HOLD_CANCEL' : 'oils://remote/xul/server/patron/hold_cancel.xul',
+    'XUL_HOLD_PLACEMENT' : 'oils://remote/xul/server/patron/place_hold.xul',
+    'XUL_IN_HOUSE_USE' : 'oils://remote/xul/server/circ/in_house_use.xul',
+    'XUL_LIST_CLIPBOARD' : 'oils://remote/xul/server/util/list_clipboard.xul',
+    'XUL_LOCAL_ADMIN' : 'oils://remote/xul/server/admin/index.xhtml',
+    'XUL_LOGIN_DATA' : 'oils://remote/xul/server/main/data.xul',
+    'XUL_MARC_NEW' : 'oils://remote/xul/server/cat/marc_new.xul',
+    'XUL_MARC_EDIT' : 'oils://remote/xul/server/cat/marcedit.xul',
+    'XUL_MARC_VIEW' : 'oils://remote/xul/server/cat/marc_view.xul',
     'XUL_MENU_FRAME' : 'chrome://open_ils_staff_client/content/main/menu_frame.xul',
-    'XUL_NON_CAT_LABEL_EDIT' : '/xul/server/admin/non_cat_types.xhtml',
-    'XUL_OFFLINE_UPLOAD_XACTS' : '/xul/server/admin/upload_xacts.xhtml',
-    'XUL_OFFLINE_MANAGE_XACTS' : '/xul/server/admin/offline_manage_xacts.xul',
-    'XUL_OFFLINE_MANAGE_XACTS_CGI' : '/cgi-bin/offline/offline.pl',
-    'XUL_OFFLINE_GENERATE_WIDGETS' : '/xul/server/main/gen_offline_widgets.xul',
-    'XUL_REMOTE_OPAC_WRAPPER' : '/xul/server/cat/opac.xul',
+    'XUL_NON_CAT_LABEL_EDIT' : 'oils://remote/xul/server/admin/non_cat_types.xhtml',
+    'XUL_OFFLINE_UPLOAD_XACTS' : 'oils://remote/xul/server/admin/upload_xacts.xhtml',
+    'XUL_OFFLINE_MANAGE_XACTS' : 'oils://remote/xul/server/admin/offline_manage_xacts.xul',
+    'XUL_OFFLINE_MANAGE_XACTS_CGI' : '/cgi-bin/offline/offline.pl', // Dunno if this needs oils://remote
+    'XUL_OFFLINE_GENERATE_WIDGETS' : 'oils://remote/xul/server/main/gen_offline_widgets.xul',
+    'XUL_REMOTE_OPAC_WRAPPER' : 'oils://remote/xul/server/cat/opac.xul',
     'XUL_OPAC_WRAPPER' : 'chrome://open_ils_staff_client/content/cat/opac.xul',
-    'XUL_PATRON_BARCODE_ENTRY' : '/xul/server/patron/barcode_entry.xul',
-    'XUL_PATRON_BILLS' : '/xul/server/patron/bill2.xul',
-    'XUL_PATRON_BILL_CC_INFO' : '/xul/server/patron/bill_cc_info.xul',
-    'XUL_PATRON_BILL_CHECK_INFO' : '/xul/server/patron/bill_check_info.xul',
-    'XUL_PATRON_BILL_DETAILS' : '/xul/server/patron/bill_details.xul',
-    'XUL_PATRON_BILL_HISTORY' : '/xul/server/patron/bill_history.xul',
-    'XUL_PATRON_BILL_WIZARD' : '/xul/server/patron/bill_wizard.xul',
-    'XUL_PATRON_DISPLAY' : '/xul/server/patron/display.xul',
-    'XUL_PATRON_HORIZ_DISPLAY' : '/xul/server/patron/display_horiz.xul',
-    'XUL_PATRON_EDIT' : '/eg/actor/user/register',
-    'XUL_PATRONS_DUE_REFUNDS' : '/xul/server/admin/patrons_due_refunds.xul',
-    'XUL_USER_PERM_EDITOR' : '/xul/server/patron/user_edit.xhtml',
-    'XUL_PATRON_HOLDS' : '/xul/server/patron/holds.xul',
-    'XUL_PATRON_INFO_NOTES' : '/xul/server/patron/info_notes.xul',
-    'XUL_PATRON_INFO_STAT_CATS' : '/xul/server/patron/info_stat_cats.xul',
-    'XUL_PATRON_INFO_SURVEYS' : '/xul/server/patron/info_surveys.xul',
-    'XUL_PATRON_INFO_GROUP' : '/xul/server/patron/info_group.xul',
-    'XUL_PATRON_ITEMS' : '/xul/server/patron/items.xul',
-    'XUL_PATRON_SEARCH_FORM' : '/xul/server/patron/search_form.xul',
-    'XUL_PATRON_HORIZONTAL_SEARCH_FORM' : '/xul/server/patron/search_form_horiz.xul',
-    'XUL_PATRON_SEARCH_RESULT' : '/xul/server/patron/search_result.xul',
-    'XUL_PATRON_SUMMARY' : '/xul/server/patron/summary.xul',
-    'XUL_PRE_CAT' : '/xul/server/circ/pre_cat_fields.xul',
-    'XUL_PRINT_LIST_TEMPLATE_EDITOR' : '/xul/server/circ/print_list_template_editor.xul',
-    'XUL_RECORD_BUCKETS' : '/xul/server/cat/record_buckets.xul',
-    'XUL_RECORD_BUCKETS_QUICK' : '/xul/server/cat/record_buckets_quick.xul',
-    'XUL_REMOTE_BROWSER' : '/xul/server/util/rbrowser.xul',
-    'XUL_SERIAL_ITEM_EDITOR' : '/xul/server/serial/sitem_editor.xul',
-    'XUL_SERIAL_NOTES' : '/xul/server/serial/notes.xul',
-    'XUL_SERIAL_SELECT_AOU' : '/xul/server/serial/select_aou.xul',
-    'XUL_SERIAL_SELECT_UNIT' : '/xul/server/serial/select_unit.xul',
-    'XUL_SERIAL_SERCTRL_MAIN' : '/xul/server/serial/serctrl_main.xul',
-    'XUL_SPINE_LABEL' : '/xul/server/cat/spine_labels.xul',
-    'XUL_STAGED_PATRONS' : '/xul/server/patron/staged.xul',
+    'XUL_PATRON_BARCODE_ENTRY' : 'oils://remote/xul/server/patron/barcode_entry.xul',
+    'XUL_PATRON_BILLS' : 'oils://remote/xul/server/patron/bill2.xul',
+    'XUL_PATRON_BILL_CC_INFO' : 'oils://remote/xul/server/patron/bill_cc_info.xul',
+    'XUL_PATRON_BILL_CHECK_INFO' : 'oils://remote/xul/server/patron/bill_check_info.xul',
+    'XUL_PATRON_BILL_DETAILS' : 'oils://remote/xul/server/patron/bill_details.xul',
+    'XUL_PATRON_BILL_HISTORY' : 'oils://remote/xul/server/patron/bill_history.xul',
+    'XUL_PATRON_BILL_WIZARD' : 'oils://remote/xul/server/patron/bill_wizard.xul',
+    'XUL_PATRON_DISPLAY' : 'oils://remote/xul/server/patron/display.xul',
+    'XUL_PATRON_HORIZ_DISPLAY' : 'oils://remote/xul/server/patron/display_horiz.xul',
+    'XUL_PATRON_EDIT' : 'oils://remote/eg/actor/user/register',
+    'XUL_PATRONS_DUE_REFUNDS' : 'oils://remote/xul/server/admin/patrons_due_refunds.xul',
+    'XUL_USER_PERM_EDITOR' : 'oils://remote/xul/server/patron/user_edit.xhtml',
+    'XUL_PATRON_HOLDS' : 'oils://remote/xul/server/patron/holds.xul',
+    'XUL_PATRON_INFO_NOTES' : 'oils://remote/xul/server/patron/info_notes.xul',
+    'XUL_PATRON_INFO_STAT_CATS' : 'oils://remote/xul/server/patron/info_stat_cats.xul',
+    'XUL_PATRON_INFO_SURVEYS' : 'oils://remote/xul/server/patron/info_surveys.xul',
+    'XUL_PATRON_INFO_GROUP' : 'oils://remote/xul/server/patron/info_group.xul',
+    'XUL_PATRON_ITEMS' : 'oils://remote/xul/server/patron/items.xul',
+    'XUL_PATRON_SEARCH_FORM' : 'oils://remote/xul/server/patron/search_form.xul',
+    'XUL_PATRON_HORIZONTAL_SEARCH_FORM' : 'oils://remote/xul/server/patron/search_form_horiz.xul',
+    'XUL_PATRON_SEARCH_RESULT' : 'oils://remote/xul/server/patron/search_result.xul',
+    'XUL_PATRON_SUMMARY' : 'oils://remote/xul/server/patron/summary.xul',
+    'XUL_PRE_CAT' : 'oils://remote/xul/server/circ/pre_cat_fields.xul',
+    'XUL_PRINT_LIST_TEMPLATE_EDITOR' : 'oils://remote/xul/server/circ/print_list_template_editor.xul',
+    'XUL_RECORD_BUCKETS' : 'oils://remote/xul/server/cat/record_buckets.xul',
+    'XUL_RECORD_BUCKETS_QUICK' : 'oils://remote/xul/server/cat/record_buckets_quick.xul',
+    'XUL_REMOTE_BROWSER' : 'oils://remote/xul/server/util/rbrowser.xul',
+    'XUL_SERIAL_ITEM_EDITOR' : 'oils://remote/xul/server/serial/sitem_editor.xul',
+    'XUL_SERIAL_NOTES' : 'oils://remote/xul/server/serial/notes.xul',
+    'XUL_SERIAL_SELECT_AOU' : 'oils://remote/xul/server/serial/select_aou.xul',
+    'XUL_SERIAL_SELECT_UNIT' : 'oils://remote/xul/server/serial/select_unit.xul',
+    'XUL_SERIAL_SERCTRL_MAIN' : 'oils://remote/xul/server/serial/serctrl_main.xul',
+    'XUL_SPINE_LABEL' : 'oils://remote/xul/server/cat/spine_labels.xul',
+    'XUL_STAGED_PATRONS' : 'oils://remote/xul/server/patron/staged.xul',
     'XUL_STANDALONE' : 'chrome://open_ils_staff_client/content/circ/offline.xul',
-    'XUL_STANDING_PENALTIES' : '/xul/server/patron/standing_penalties.xul',
-    'XUL_NEW_STANDING_PENALTY' : '/xul/server/patron/new_standing_penalty.xul',
-    'XUL_EDIT_STANDING_PENALTY' : '/xul/server/patron/edit_standing_penalty.xul',
-    'XUL_SCAN_ITEM_AS_MISSING_PIECES' : '/xul/server/circ/missing_pieces.xul',
-    'XUL_STAT_CAT_EDIT' : '/xul/server/admin/stat_cat_editor.xhtml',
+    'XUL_STANDING_PENALTIES' : 'oils://remote/xul/server/patron/standing_penalties.xul',
+    'XUL_NEW_STANDING_PENALTY' : 'oils://remote/xul/server/patron/new_standing_penalty.xul',
+    'XUL_EDIT_STANDING_PENALTY' : 'oils://remote/xul/server/patron/edit_standing_penalty.xul',
+    'XUL_SCAN_ITEM_AS_MISSING_PIECES' : 'oils://remote/xul/server/circ/missing_pieces.xul',
+    'XUL_STAT_CAT_EDIT' : 'oils://remote/xul/server/admin/stat_cat_editor.xhtml',
     'XUL_SURVEY_WIZARD' : 'chrome://open_ils_staff_client/content/admin/survey_wizard.xul',
-    'XUL_TIMESTAMP_DIALOG' : '/xul/server/util/timestamp.xul',
-    'XUL_TOOLBAR_CONFIG' : '/xul/server/admin/toolbar.xul',
-    'XUL_USER_BUCKETS' : '/xul/server/patron/user_buckets.xul',
-    'XUL_VERIFY_CREDENTIALS' : '/xul/server/main/verify_credentials.xul',
-    'XUL_VOLUME_BUCKETS' : '/xul/server/cat/volume_buckets.xul',
-    'XUL_VOLUME_COPY_CREATOR' : '/xul/server/cat/volume_copy_editor.xul',
-    'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : '/xul/server/cat/volume_copy_editor_horiz.xul',
-    'XUL_VOLUME_COPY_CREATOR_ORIGINAL' : '/xul/server/cat/volume_copy_creator.xul',
-    'XUL_VOLUME_EDITOR' : '/xul/server/cat/volume_editor.xul',
-    'XUL_WORK_LOG' : '/xul/server/admin/work_log.xul',
-    'XUL_WORKSTATION_INFO' : '/xul/server/main/ws_info.xul',
-    'XUL_Z3950_IMPORT' : '/xul/server/cat/z3950.xul',
-    'TEST_HTML' : '/xul/server/main/test.html',
-    'TEST_XUL' : '/xul/server/main/test.xul',
-    'CONIFY' : '/conify/' + LOCALE + '/global',
-    'CONIFY_MANAGE_PARTS' : '/eg/conify/global/biblio/monograph_part',
-    'EG_WEB_BASE' : '/eg',
-    'XUL_LOCAL_ADMIN_BASE' : '/xul/server/admin',
-    'XUL_REPORTS' : '/reports/oils_rpt.xhtml',
+    'XUL_TIMESTAMP_DIALOG' : 'oils://remote/xul/server/util/timestamp.xul',
+    'XUL_TOOLBAR_CONFIG' : 'oils://remote/xul/server/admin/toolbar.xul',
+    'XUL_USER_BUCKETS' : 'oils://remote/xul/server/patron/user_buckets.xul',
+    'XUL_VERIFY_CREDENTIALS' : 'oils://remote/xul/server/main/verify_credentials.xul',
+    'XUL_VOLUME_BUCKETS' : 'oils://remote/xul/server/cat/volume_buckets.xul',
+    'XUL_VOLUME_COPY_CREATOR' : 'oils://remote/xul/server/cat/volume_copy_editor.xul',
+    'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : 'oils://remote/xul/server/cat/volume_copy_editor_horiz.xul',
+    'XUL_VOLUME_COPY_CREATOR_ORIGINAL' : 'oils://remote/xul/server/cat/volume_copy_creator.xul',
+    'XUL_VOLUME_EDITOR' : 'oils://remote/xul/server/cat/volume_editor.xul',
+    'XUL_WORK_LOG' : 'oils://remote/xul/server/admin/work_log.xul',
+    'XUL_WORKSTATION_INFO' : 'oils://remote/xul/server/main/ws_info.xul',
+    'XUL_Z3950_IMPORT' : 'oils://remote/xul/server/cat/z3950.xul',
+    'TEST_HTML' : '/xul/server/main/test.html', // This is html, not xul....does it need oils://remote?
+    'TEST_XUL' : 'oils://remote/xul/server/main/test.xul',
+    'CONIFY' : 'oils://remote/conify/' + LOCALE + '/global',
+    'CONIFY_MANAGE_PARTS' : 'oils://remote/eg/conify/global/biblio/monograph_part',
+    'EG_WEB_BASE' : 'oils://remote/eg',
+    'XUL_LOCAL_ADMIN_BASE' : 'oils://remote/xul/server/admin',
+    'XUL_REPORTS' : 'oils://remote/reports/oils_rpt.xhtml',
     'EG_ACQ_PO_VIEW' : '/eg/acq/po/view',
     'EG_ACQ_USER_REQUESTS' : '/eg/acq/picklist/user_request',
-    'XUL_SERIAL_BATCH_RECEIVE': '/xul/server/serial/batch_receive.xul',
-    'EG_TRIGGER_EVENTS' : '/eg/actor/user/event_log'
+    'XUL_SERIAL_BATCH_RECEIVE': 'oils://remote/xul/server/serial/batch_receive.xul',
+    'XUL_SERIAL_PATTERN_WIZARD' : '/xul/server/serial/pattern_wizard.xul',
+    'CUSTOM_JS' : '/xul/server/skin/custom.js',
+    'ACQ_LINEITEM' : 'oils://remote/eg/acq/lineitem/related/',
+    'SERIAL_LIST_SUBSCRIPTION' : 'oils://remote/eg/serial/list_subscription',
+    'BOOKING_RESOURCE' : 'oils://remote/eg/conify/global/booking/resource',
+    'BOOKING_RESERVATION' : 'oils://remote/eg/booking/reservation',
+    'BOOKING_PICKUP' : 'oils://remote/eg/booking/pickup',
+    'BOOKING_RETURN' : 'oils://remote/eg/booking/return',
+    'ALT_HOLDS_PRINT' : 'oils://remote/opac/extras/circ/alt_holds_print.html',
+    'SERIAL_PRINT_ROUTING_LIST_USERS' : 'oils://remote/eg/serial/print_routing_list_users',
+    'XUL_SERIAL_BATCH_RECEIVE': 'oils://remote/xul/server/serial/batch_receive.xul',
+    'EG_TRIGGER_EVENTS' : 'oils://remote/eg/actor/user/event_log'
 }
 
 if(use_tpac) {
-    urls['opac'] = '/eg/opac/advanced';
-    urls['opac_rdetail'] = '/eg/opac/record/';
-    urls['opac_rresult'] = '/eg/opac/results';
-    urls['opac_rresult_metarecord'] = '/eg/opac/results?metarecord=';
+    urls['opac'] = 'oils://remote/eg/opac/advanced';
+    urls['opac_rdetail'] = 'oils://remote/eg/opac/record/';
+    urls['opac_rresult'] = 'oils://remote/eg/opac/results';
+    urls['opac_rresult_metarecord'] = 'oils://remote/eg/opac/results?metarecord=';
     urls['browser'] = urls.opac;
     pref.setBoolPref('oils.secure_opac',true);
 }
diff --git a/Open-ILS/xul/staff_client/chrome/content/main/main.js b/Open-ILS/xul/staff_client/chrome/content/main/main.js
index 73983c3..44d7f72 100644
--- a/Open-ILS/xul/staff_client/chrome/content/main/main.js
+++ b/Open-ILS/xul/staff_client/chrome/content/main/main.js
@@ -8,20 +8,6 @@ var openTabs = new Array();
 var tempWindow = null;
 var tempFocusWindow = null;
 
-function grant_perms(url) {
-    var perms = "UniversalXPConnect UniversalPreferencesWrite UniversalBrowserWrite UniversalPreferencesRead UniversalBrowserRead UniversalFileRead";
-    dump('Granting ' + perms + ' to ' + url + '\n');
-    if (G.pref) {
-        G.pref.setCharPref("capability.principal.codebase.p0.granted", perms);
-        G.pref.setCharPref("capability.principal.codebase.p0.id", url);
-        G.pref.setCharPref("capability.principal.codebase.p1.granted", perms);
-        G.pref.setCharPref("capability.principal.codebase.p1.id", url.replace('http:','https:'));
-        G.pref.setBoolPref("dom.disable_open_during_load",false);
-        G.pref.setBoolPref("browser.popups.showPopupBlocker",false);
-    }
-
-}
-
 function clear_the_cache() {
     try {
         var cacheClass         = Components.classes["@mozilla.org/network/cache-service;1"];
@@ -79,7 +65,6 @@ function new_tabs(aTabList, aContinue) {
         openTabs = openTabs.concat(aTabList);
     }
     if(G.data.session) { // Just add to the list of stuff to open unless we are logged in
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var targetwindow = null;
         var focuswindow = null;
         var focustab = {'focus' : true};
@@ -233,18 +218,36 @@ function get_menu_perms(indocument) {
 function load_hotkey_sets() {
     if(typeof(load_hotkey_sets.set_list) == 'undefined') {
         load_hotkey_sets.set_list = [];
-        JSAN.use('util.file');
-        var file = new util.file();
-        var dirEntries = file.get('hotkeys','skin').directoryEntries;
-        while(dirEntries.hasMoreElements()) {
-            var entry = dirEntries.getNext();
-            entry.QueryInterface(Components.interfaces.nsIFile);
-            if(!entry.isFile()) continue;
-            if(!entry.leafName.match(/.+\.keyset$/)) continue;
-            var keysetname = entry.leafName.replace(/\.keyset$/,'');
-            load_hotkey_sets.set_list.push(keysetname);
+        // We can't safely use util.file here because extensions aren't unpacked in Firefox 4+
+        // So instead we will use and parse information from a chrome:// URL
+        var hotkeysBase = 'chrome://open_ils_staff_client/skin/hotkeys/';
+        var ioService=Components.classes["@mozilla.org/network/io-service;1"]
+            .getService(Components.interfaces.nsIIOService);
+        var scriptableStream=Components
+            .classes["@mozilla.org/scriptableinputstream;1"]
+            .getService(Components.interfaces.nsIScriptableInputStream);
+
+        var channel=ioService.newChannel(hotkeysBase,null,null);
+        var input=channel.open();
+        var str = '';
+        scriptableStream.init(input);
+        try {
+            while(input.available()) {
+                str+=scriptableStream.read(input.available());
+            }
+        } catch (E) {}
+        scriptableStream.close();
+        input.close();
+        // str now, in theory, has a list of files (and metadata) for our base chrome URL.
+        str = str.replace(/^(?!201: ).*$/gm,''); // Remove non-filename result lines
+        str = str.replace(/^(?!.*\.keyset).*$/gm,''); // Remove non-keyset file result lines
+        str = str.replace(/^201: (.*)\.keyset.*$/gm, "$1"); // Reduce keyset matches to just base names
+        // Split into an array
+        var files = str.trim().split(/[\r\n]+/g);
+        for (var i = 0; i < files.length; i++) {
+            if(files[i].length = 0) continue;
+            load_hotkey_sets.set_list.push(files[i]);
         }
-        file.close();
     }
     return load_hotkey_sets.set_list;
 }
@@ -256,41 +259,51 @@ function get_hotkey_array(keyset_name) {
     }
     if(get_hotkey_array.keyset_cache[keyset_name])
         return get_hotkey_array.keyset_cache[keyset_name];
-    JSAN.use('util.file');
-    var file = new util.file();
-    var keyset_raw;
+    // We can't safely use util.file here because extensions aren't unpacked in Firefox 4+
+    // So instead we will use and parse information from a chrome:// URL
+    var hotkeysBase = 'chrome://open_ils_staff_client/skin/hotkeys/' + keyset_name + '.keyset';
+    var ioService=Components.classes["@mozilla.org/network/io-service;1"]
+        .getService(Components.interfaces.nsIIOService);
+    var scriptableStream=Components
+        .classes["@mozilla.org/scriptableinputstream;1"]
+        .getService(Components.interfaces.nsIScriptableInputStream);
+
+    var channel=ioService.newChannel(hotkeysBase,null,null);
+    var input=channel.open();
+    var keyset_raw = '';
+    scriptableStream.init(input);
     try {
-        var keyset_file = file.get('hotkeys','skin');
-        keyset_file.append(keyset_name + ".keyset");
-        keyset_raw = file.get_content();
-        file.close();
-        var tempArray = [];
-
-        var keyset_lines = keyset_raw.trim().split("\n");
-        for(var line = 0; line < keyset_lines.length; line++) {
-            // Grab line, strip comments, strip leading/trailing whitespace
-            var curline = keyset_lines[line].replace(/\s*#.*$/,'').trim();
-            if(curline == "") continue; // Skip empty lines
-            // Split into pieces
-            var split_line = curline.split(',');
-            // We need at least 3 elements. Command, modifiers, keycode.
-            if(split_line.length < 3) continue;
-            // Trim each segment
-            split_line[0] = split_line[0].trim();
-            split_line[1] = split_line[1].trim();
-            split_line[2] = split_line[2].trim();
-            if(split_line.length > 3)
-                split_line[3] = split_line[3].trim();
-            // Skip empty commands
-            if(split_line[0] == "") continue;
-            // Push to array
-            tempArray.push(split_line);
+        while(input.available()) {
+            keyset_raw+=scriptableStream.read(input.available());
         }
-        get_hotkey_array.keyset_cache[keyset_name] = tempArray;
-        return tempArray;
-    } catch(E) { // Something went wrong.
-        return false;
+    } catch (E) {}
+    scriptableStream.close();
+    input.close();
+
+    var tempArray = [];
+
+    var keyset_lines = keyset_raw.trim().split("\n");
+    for(var line = 0; line < keyset_lines.length; line++) {
+        // Grab line, strip comments, strip leading/trailing whitespace
+        var curline = keyset_lines[line].replace(/\s*#.*$/,'').trim();
+        if(curline == "") continue; // Skip empty lines
+        // Split into pieces
+        var split_line = curline.split(',');
+        // We need at least 3 elements. Command, modifiers, keycode.
+        if(split_line.length < 3) continue;
+        // Trim each segment
+        split_line[0] = split_line[0].trim();
+        split_line[1] = split_line[1].trim();
+        split_line[2] = split_line[2].trim();
+        if(split_line.length > 3)
+            split_line[3] = split_line[3].trim();
+        // Skip empty commands
+        if(split_line[0] == "") continue;
+        // Push to array
+        tempArray.push(split_line);
     }
+    get_hotkey_array.keyset_cache[keyset_name] = tempArray;
+    return tempArray;
 }
 
 function main_init() {
@@ -301,6 +314,17 @@ function main_init() {
             openTabs = openTabs.concat(window.arguments[0].wrappedJSObject.openTabs);
         }
 
+        // Disable commands that we can't do anything with right now
+        if(typeof start_venkman != 'function') {
+            document.getElementById('cmd_debugger').setAttribute('disabled','true');
+        }
+        if(typeof inspectDOMDocument != 'function') {
+            document.getElementById('cmd_inspector').setAttribute('disabled','true');
+        }
+        if(typeof startChromeList != 'function') {
+            document.getElementById('cmd_chrome_list').setAttribute('disabled','true');
+        }
+
         // Now we can safely load the strings without the cache getting wiped
         offlineStrings = document.getElementById('offlineStrings');
         authStrings = document.getElementById('authStrings');
@@ -322,9 +346,6 @@ function main_init() {
         
         G.pref = Components.classes["@mozilla.org/preferences-service;1"].getService(Components.interfaces.nsIPrefBranch);
         G.pref.QueryInterface(Components.interfaces.nsIPrefBranch2);
-        if (! G.pref.prefHasUserValue('general.useragent.override')) {
-            G.pref.setCharPref('general.useragent.override',navigator.userAgent + ' oils_xulrunner /xul/server/');
-        }
 
         JSAN.use('util.error');
         G.error = new util.error();
@@ -356,28 +377,22 @@ function main_init() {
 
             G.data.server_unadorned = url; G.data.stash('server_unadorned'); G.data.stash_retrieve();
 
-            if (! url.match( '^http://' ) ) { url = 'http://' + url; }
+            if (! url.match( '^(http|https)://' ) ) { url = 'http://' + url; }
 
             G.data.server = url; G.data.stash('server'); 
             G.data.session = { 'key' : G.auth.session.key, 'auth' : G.auth.session.authtime }; G.data.stash('session');
             G.data.stash_retrieve();
             try {
                 var ios = Components.classes["@mozilla.org/network/io-service;1"].getService(Components.interfaces.nsIIOService);
-                var cookieUri = ios.newURI("http://" + G.data.server_unadorned, null, null);
                 var cookieUriSSL = ios.newURI("https://" + G.data.server_unadorned, null, null);
                 var cookieSvc = Components.classes["@mozilla.org/cookieService;1"].getService(Components.interfaces.nsICookieService);
 
-                cookieSvc.setCookieString(cookieUri, null, "ses="+G.data.session.key, null);
-                cookieSvc.setCookieString(cookieUriSSL, null, "ses="+G.data.session.key, null);
-                cookieSvc.setCookieString(cookieUri, null, "xul=1", null);
-                cookieSvc.setCookieString(cookieUriSSL, null, "xul=1", null);
+                cookieSvc.setCookieString(cookieUriSSL, null, "ses="+G.data.session.key + "; secure;", null);
 
             } catch(E) {
                 alert(offlineStrings.getFormattedString(main.session_cookie.error, [E]));
             }
 
-            grant_perms(url);
-
             xulG = {
                 'auth' : G.auth,
                 'url' : url,
@@ -391,7 +406,7 @@ function main_init() {
                 var deck = document.getElementById('progress_space');
                 util.widgets.remove_children( deck );
                 var iframe = document.createElement('iframe'); deck.appendChild(iframe);
-                iframe.setAttribute( 'src', url + urls.XUL_LOGIN_DATA );
+                iframe.setAttribute( 'src', urls.XUL_LOGIN_DATA );
                 iframe.contentWindow.xulG = xulG;
                 G.data_xul = iframe.contentWindow;
             } else {
@@ -399,7 +414,7 @@ function main_init() {
                 var deck = G.auth.controller.view.ws_deck;
                 JSAN.use('util.widgets'); util.widgets.remove_children('ws_deck');
                 var iframe = document.createElement('iframe'); deck.appendChild(iframe);
-                iframe.setAttribute( 'src', url + urls.XUL_WORKSTATION_INFO );
+                iframe.setAttribute( 'src', urls.XUL_WORKSTATION_INFO );
                 iframe.contentWindow.xulG = xulG;
                 deck.selectedIndex = deck.childNodes.length - 1;
             }
@@ -750,6 +765,7 @@ function handle_migration() {
 }
 
 function auto_login(loginInfo) {
+    G.data.stash_retrieve();
     if(G.data.session) return; // We are logged in. No auto-logoff supported.
     if(loginInfo.host) G.auth.controller.view.server_prompt.value = loginInfo.host;
     if(loginInfo.user) G.auth.controller.view.name_prompt.value = loginInfo.user;
diff --git a/Open-ILS/xul/staff_client/chrome/content/main/menu.js b/Open-ILS/xul/staff_client/chrome/content/main/menu.js
index d10c503..a3bd477 100644
--- a/Open-ILS/xul/staff_client/chrome/content/main/menu.js
+++ b/Open-ILS/xul/staff_client/chrome/content/main/menu.js
@@ -6,7 +6,6 @@ var offlineStrings;
 if (typeof main == 'undefined') main = {};
 main.menu = function () {
 
-    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
     offlineStrings = document.getElementById('offlineStrings');
     JSAN.use('util.error'); this.error = new util.error();
     JSAN.use('util.window'); this.window = new util.window();
@@ -39,6 +38,14 @@ main.menu.prototype = {
     'toolbar_labelpos' : 'side',
 
     'url_prefix' : function(url,secure) {
+        // This allows urls to start with a urls key (or be only a urls key)
+        // We stop at the first / or ? to allow extra paths and query strings.
+        var base_url = url.match(/^[^?/|]+/);
+        if(base_url) {
+            base_url = base_url[0];
+            if(urls[base_url])
+                url = url.replace(/^[^?/|]+\|?/, urls[base_url]);
+        }
         // if host unspecified URL with leading /, prefix the remote hostname
         if (url.match(/^\//)) url = urls.remote + url;
         // if it starts with http:// and we want secure, convert to https://
@@ -46,7 +53,7 @@ main.menu.prototype = {
             url = url.replace(/^http:\/\//, 'https://');
         }
         // if it doesn't start with a known protocol, add http(s)://
-        if (! url.match(/^(http|https|chrome):\/\//) && ! url.match(/^data:/) ) {
+        if (! url.match(/^(http|https|chrome|oils):\/\//) && ! url.match(/^data:/) ) {
             url = secure
                 ? 'https://' + url
                 : 'http://' + url;
@@ -64,12 +71,31 @@ main.menu.prototype = {
         xulG.get_barcode = this.get_barcode;
         xulG.get_barcode_and_settings = this.get_barcode_and_settings;
 
+        // Disable commands that we can't do anything with right now
+        if(typeof xulG.window.win.start_venkman != 'function') {
+            var element = document.getElementById('cmd_debug_venkman');
+            element.setAttribute('disabled','true');
+            element.removeAttribute('perm');
+        }
+        if(typeof xulG.window.win.inspectDOMDocument != 'function') {
+            var element = document.getElementById('cmd_debug_inspector');
+            element.setAttribute('disabled','true');
+            element.removeAttribute('perm');
+        }
+        if(typeof xulG.window.win.startChromeList != 'function') {
+            var element = document.getElementById('cmd_debug_chrome_list');
+            element.setAttribute('disabled','true');
+            element.removeAttribute('perm');
+        }
+
+
         // Pull in local customizations
         var r = new XMLHttpRequest();
-        r.open("GET", obj.url_prefix('/xul/server/skin/custom.js'), false);
+        var custom_js = obj.url_prefix('CUSTOM_JS');
+        r.open("GET", custom_js, false);
         r.send(null);
         if (r.status == 200) {
-            dump('Evaluating /xul/server/skin/custom.js\n');
+            dump('Evaluating ' + custom_js + '\n');
             eval( r.responseText );
         }
 
@@ -126,7 +152,7 @@ main.menu.prototype = {
             label = offlineStrings.getString(labelKey);
 
             // URL
-            var loc = urls.XUL_BROWSER + '?url=' + window.escape( obj.url_prefix(urls.CONIFY) + '/' + path + '.html');
+            var loc = urls.XUL_BROWSER + '?url=' + window.escape( obj.url_prefix('CONIFY/') + path + '.html');
 
             obj.command_tab(
                 event,
@@ -143,7 +169,7 @@ main.menu.prototype = {
             label = offlineStrings.getString(labelKey);
 
             // URL
-            var loc = urls.XUL_BROWSER + '?url=' + window.escape( obj.url_prefix(urls.XUL_LOCAL_ADMIN_BASE) + '/' + path);
+            var loc = urls.XUL_BROWSER + '?url=' + window.escape( obj.url_prefix('XUL_LOCAL_ADMIN_BASE/') + path);
             if(addSes) loc += window.escape('?ses=' + ses());
 
             obj.command_tab( 
@@ -162,7 +188,7 @@ main.menu.prototype = {
             var label = offlineStrings.getString(labelKey);
 
             // URL
-            var loc = urls.XUL_BROWSER + '?url=' + window.escape(obj.url_prefix(urls.EG_WEB_BASE) + '/' + path);
+            var loc = urls.XUL_BROWSER + '?url=' + window.escape(obj.url_prefix('EG_WEB_BASE/') + path);
 
             obj.command_tab(
                 event,
@@ -252,28 +278,28 @@ main.menu.prototype = {
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_COPY_BUCKETS),{'tab_name':offlineStrings.getString('menu.cmd_edit_copy_buckets.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_COPY_BUCKETS'),{'tab_name':offlineStrings.getString('menu.cmd_edit_copy_buckets.tab')},{});
                 }
             ],
             'cmd_edit_volume_buckets' : [
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_VOLUME_BUCKETS),{'tab_name':offlineStrings.getString('menu.cmd_edit_volume_buckets.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_VOLUME_BUCKETS'),{'tab_name':offlineStrings.getString('menu.cmd_edit_volume_buckets.tab')},{});
                 }
             ],
             'cmd_edit_record_buckets' : [
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_RECORD_BUCKETS),{'tab_name':offlineStrings.getString('menu.cmd_edit_record_buckets.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_RECORD_BUCKETS'),{'tab_name':offlineStrings.getString('menu.cmd_edit_record_buckets.tab')},{});
                 }
             ],
             'cmd_edit_user_buckets' : [
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_USER_BUCKETS),{'tab_name':offlineStrings.getString('menu.cmd_edit_user_buckets.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_USER_BUCKETS'),{'tab_name':offlineStrings.getString('menu.cmd_edit_user_buckets.tab')},{});
                 }
             ],
 
@@ -373,7 +399,7 @@ main.menu.prototype = {
                 function(event) {
                     obj.data.stash_retrieve();
                     var content_params = { 'session' : ses(), 'authtime' : ses('authtime') };
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_OPAC_WRAPPER), {'tab_name':offlineStrings.getString('menu.cmd_search_opac.tab')}, content_params);
+                    obj.command_tab(event,obj.url_prefix('XUL_OPAC_WRAPPER'), {'tab_name':offlineStrings.getString('menu.cmd_search_opac.tab')}, content_params);
                 }
             ],
             'cmd_search_tcn' : [
@@ -384,7 +410,7 @@ main.menu.prototype = {
                     function spawn_tcn(r,event) {
                         for (var i = 0; i < r.count; i++) {
                             var id = r.ids[i];
-                            var opac_url = obj.url_prefix( urls.opac_rdetail ) + id;
+                            var opac_url = obj.url_prefix('opac_rdetail') + id;
                             obj.data.stash_retrieve();
                             var content_params = { 
                                 'session' : ses(), 
@@ -394,13 +420,13 @@ main.menu.prototype = {
                             if (i == 0) {
                                 obj.command_tab(
                                     event,
-                                    obj.url_prefix(urls.XUL_OPAC_WRAPPER), 
+                                    obj.url_prefix('XUL_OPAC_WRAPPER'), 
                                     {'tab_name':tcn}, 
                                     content_params
                                 );
                             } else {
                                 obj.new_tab(
-                                    obj.url_prefix(urls.XUL_OPAC_WRAPPER), 
+                                    obj.url_prefix('XUL_OPAC_WRAPPER'), 
                                     {'tab_name':tcn}, 
                                     content_params
                                 );
@@ -434,7 +460,7 @@ main.menu.prototype = {
                     var bib_id = prompt(offlineStrings.getString('menu.cmd_search_bib_id.tab'),'',offlineStrings.getString('menu.cmd_search_bib_id.prompt'));
                     if (!bib_id) return;
 
-                    var opac_url = obj.url_prefix( urls.opac_rdetail ) + bib_id;
+                    var opac_url = obj.url_prefix('opac_rdetail') + bib_id;
                     var content_params = { 
                         'session' : ses(), 
                         'authtime' : ses('authtime'),
@@ -442,7 +468,7 @@ main.menu.prototype = {
                     };
                     obj.command_tab(
                         event,
-                        obj.url_prefix(urls.XUL_OPAC_WRAPPER), 
+                        obj.url_prefix('XUL_OPAC_WRAPPER'), 
                         {'tab_name':'#' + bib_id}, 
                         content_params
                     );
@@ -452,7 +478,7 @@ main.menu.prototype = {
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_COPY_STATUS),{},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_COPY_STATUS'),{},{});
                 }
             ],
 
@@ -483,13 +509,13 @@ main.menu.prototype = {
                     }
 
                     function spawn_editor(p) {
-                        var url = urls.XUL_PATRON_EDIT;
+                        var url = 'XUL_PATRON_EDIT';
                         var param_count = 0;
                         for (var i in p) {
                             if (param_count++ == 0) url += '?'; else url += '&';
                             url += i + '=' + window.escape(p[i]);
                         }
-                        var loc = obj.url_prefix( urls.XUL_BROWSER ) + '?url=' + window.escape( obj.url_prefix(url) );
+                        var loc = obj.url_prefix('XUL_BROWSER?url=') + window.escape( obj.url_prefix(url) );
                         obj.new_tab(
                             loc, 
                             {}, 
@@ -506,8 +532,8 @@ main.menu.prototype = {
                     }
 
                     obj.data.stash_retrieve();
-                    var loc = obj.url_prefix( urls.XUL_BROWSER ) 
-                        + '?url=' + window.escape( obj.url_prefix(urls.XUL_PATRON_EDIT) );
+                    var loc = obj.url_prefix('XUL_BROWSER?url=') 
+                        + window.escape( obj.url_prefix('XUL_PATRON_EDIT') );
                     obj.command_tab(
                         event,
                         loc, 
@@ -529,42 +555,42 @@ main.menu.prototype = {
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_STAGED_PATRONS),{'tab_name':offlineStrings.getString('menu.circulation.staged_patrons.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_STAGED_PATRONS'),{'tab_name':offlineStrings.getString('menu.circulation.staged_patrons.tab')},{});
                 }
             ],
             'cmd_circ_checkin' : [
                 ['oncommand'],
                 function(event) { 
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_CHECKIN),{},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_CHECKIN'),{},{});
                 }
             ],
             'cmd_circ_renew' : [
                 ['oncommand'],
                 function(event) { 
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_RENEW),{},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_RENEW'),{},{});
                 }
             ],
             'cmd_circ_checkout' : [
                 ['oncommand'],
                 function(event) { 
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_PATRON_BARCODE_ENTRY),{},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_PATRON_BARCODE_ENTRY'),{},{});
                 }
             ],
             'cmd_circ_hold_capture' : [
                 ['oncommand'],
                 function(event) { 
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_CHECKIN)+'?hold_capture=1',{},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_CHECKIN?hold_capture=1'),{},{});
                 }
             ],
             'cmd_browse_holds_shelf' : [
                 ['oncommand'],
                 function(event) { 
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_HOLDS_BROWSER)+'?shelf=1',{ 'tab_name' : offlineStrings.getString('menu.cmd_browse_holds_shelf.tab') },{});
+                    obj.command_tab(event,obj.url_prefix('XUL_HOLDS_BROWSER?shelf=1'),{ 'tab_name' : offlineStrings.getString('menu.cmd_browse_holds_shelf.tab') },{});
                 }
             ],
             'cmd_clear_holds_shelf' : [
@@ -589,7 +615,7 @@ main.menu.prototype = {
                 function(event) { 
                     obj.data.stash_retrieve();
                     var loc = urls.XUL_BROWSER + '?url=' + window.escape(
-                        obj.url_prefix(urls.XUL_HOLD_PULL_LIST)
+                        obj.url_prefix('XUL_HOLD_PULL_LIST')
                     );
                     obj.command_tab(event, loc, {'tab_name' : offlineStrings.getString('menu.cmd_browse_hold_pull_list.tab')} );
                 }
@@ -599,21 +625,21 @@ main.menu.prototype = {
                 ['oncommand'],
                 function(event) { 
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_IN_HOUSE_USE),{},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_IN_HOUSE_USE'),{},{});
                 }
             ],
 
             'cmd_scan_item_as_missing_pieces' : [
                 ['oncommand'],
                 function() { 
-                    xulG.window.open(obj.url_prefix(urls.XUL_SCAN_ITEM_AS_MISSING_PIECES),'scan_missing_pieces','chrome'); 
+                    xulG.window.open(obj.url_prefix('XUL_SCAN_ITEM_AS_MISSING_PIECES'),'scan_missing_pieces','chrome'); 
                 }
             ],
 
             'cmd_standalone' : [
                 ['oncommand'],
                 function() { 
-                    //obj.set_tab(obj.url_prefix(urls.XUL_STANDALONE),{},{});
+                    //obj.set_tab(obj.url_prefix('XUL_STANDALONE'),{},{});
                     window.open(urls.XUL_STANDALONE,'Offline','chrome,resizable');
                 }
             ],
@@ -621,9 +647,9 @@ main.menu.prototype = {
             'cmd_local_admin' : [
                 ['oncommand'],
                 function(event) { 
-                    //obj.set_tab(obj.url_prefix(urls.XUL_LOCAL_ADMIN)+'?ses='+window.escape(ses())+'&session='+window.escape(ses()),{},{});
+                    //obj.set_tab(obj.url_prefix('XUL_LOCAL_ADMIN')+'?ses='+window.escape(ses())+'&session='+window.escape(ses()),{},{});
                     var loc = urls.XUL_BROWSER + '?url=' + window.escape(
-                        obj.url_prefix( urls.XUL_LOCAL_ADMIN+'?ses='+window.escape(ses())+'&session='+window.escape(ses()) )
+                        obj.url_prefix( 'XUL_LOCAL_ADMIN?ses='+window.escape(ses())+'&session='+window.escape(ses()) )
                     );
                     obj.command_tab(
                         event,
@@ -648,7 +674,7 @@ main.menu.prototype = {
             'cmd_local_admin_reports' : [
                 ['oncommand'],
                 function(event) { 
-                    var loc = urls.XUL_BROWSER + '?url=' + window.escape( obj.url_prefix(urls.XUL_REPORTS) + '?ses=' + ses());
+                    var loc = urls.XUL_BROWSER + '?url=' + window.escape( obj.url_prefix('XUL_REPORTS?ses=') + ses());
                     obj.command_tab(
                         event,
                         loc, 
@@ -684,7 +710,7 @@ main.menu.prototype = {
             'cmd_local_admin_do_not_auto_attempt_print_setting' : [
                 ['oncommand'],
                 function(event) { 
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_DO_NOT_AUTO_ATTEMPT_PRINT_SETTING),{'tab_name':offlineStrings.getString('menu.cmd_local_admin_do_not_auto_attempt_print_setting.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_DO_NOT_AUTO_ATTEMPT_PRINT_SETTING'),{'tab_name':offlineStrings.getString('menu.cmd_local_admin_do_not_auto_attempt_print_setting.tab')},{});
                 }
             ],
             'cmd_local_admin_closed_dates' : [
@@ -839,7 +865,7 @@ main.menu.prototype = {
                 function(event) {
                     obj.command_tab(
                         event,
-                        obj.url_prefix(urls.XUL_PATRONS_DUE_REFUNDS),
+                        obj.url_prefix('XUL_PATRONS_DUE_REFUNDS'),
                         { 'tab_name' : offlineStrings.getString('menu.local_admin.patrons_due_refunds.tab') },
                         {}
                     );
@@ -1148,7 +1174,7 @@ main.menu.prototype = {
                         return;
                     }
                     var horizontal_interface = String( obj.data.hash.aous['ui.circ.patron_summary.horizontal'] ) == 'true';
-                    var url = obj.url_prefix( horizontal_interface ? urls.XUL_PATRON_HORIZ_DISPLAY : urls.XUL_PATRON_DISPLAY );
+                    var url = obj.url_prefix( horizontal_interface ? 'XUL_PATRON_HORIZ_DISPLAY' : 'XUL_PATRON_DISPLAY' );
                     obj.command_tab( event, url, {}, { 'id' : obj.data.last_patron } );
                 }
             ],
@@ -1161,7 +1187,7 @@ main.menu.prototype = {
                         alert(offlineStrings.getString('menu.cmd_retrieve_last_record.session.error'));
                         return;
                     }
-                    var opac_url = obj.url_prefix( urls.opac_rdetail ) + obj.data.last_record;
+                    var opac_url = obj.url_prefix('opac_rdetail') + obj.data.last_record;
                     var content_params = {
                         'session' : ses(),
                         'authtime' : ses('authtime'),
@@ -1169,7 +1195,7 @@ main.menu.prototype = {
                     };
                     obj.command_tab(
                         event,
-                        obj.url_prefix(urls.XUL_OPAC_WRAPPER),
+                        obj.url_prefix('XUL_OPAC_WRAPPER'),
                         {'tab_name' : offlineStrings.getString('menu.cmd_retrieve_last_record.status')},
                         content_params
                     );
@@ -1181,7 +1207,7 @@ main.menu.prototype = {
                 function(event) {
                     obj.command_tab(
                         event,
-                        obj.url_prefix(urls.XUL_VERIFY_CREDENTIALS),
+                        obj.url_prefix('XUL_VERIFY_CREDENTIALS'),
                         { 'tab_name' : offlineStrings.getString('menu.cmd_verify_credentials.tabname') },
                         {}
                     );
@@ -1193,14 +1219,14 @@ main.menu.prototype = {
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_Z3950_IMPORT),{},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_Z3950_IMPORT'),{},{});
                 }
             ],
             'cmd_create_marc' : [
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_MARC_NEW),{},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_MARC_NEW'),{},{});
                 }
             ],
 
@@ -1220,7 +1246,7 @@ main.menu.prototype = {
                 function(event) {
                     obj.command_tab(
                         event,
-                        obj.url_prefix(urls.MARC_BATCH_EDIT),{
+                        obj.url_prefix('MARC_BATCH_EDIT'),{
                             'tab_name' : offlineStrings.getString('menu.cmd_marc_batch_edit.tab')
                         },
                         {}
@@ -1247,14 +1273,11 @@ main.menu.prototype = {
                             obj.data.stash('session');
                             obj.data.stash('menu_perms');
                             try {
-                                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                 var ios = Components.classes["@mozilla.org/network/io-service;1"].getService(Components.interfaces.nsIIOService);
-                                var cookieUri = ios.newURI("http://" + obj.data.server_unadorned, null, null);
                                 var cookieUriSSL = ios.newURI("https://" + obj.data.server_unadorned, null, null);
                                 var cookieSvc = Components.classes["@mozilla.org/cookieService;1"].getService(Components.interfaces.nsICookieService);
 
-                                cookieSvc.setCookieString(cookieUri, null, "ses="+obj.data.session.key, null);
-                                cookieSvc.setCookieString(cookieUriSSL, null, "ses="+obj.data.session.key, null);
+                                cookieSvc.setCookieString(cookieUriSSL, null, "ses="+obj.data.session.key + "; secure;", null);
 
                         } catch(E) {
                             alert(offlineStrings.getFormattedString(main.session_cookie.error, [E]));
@@ -1282,14 +1305,13 @@ main.menu.prototype = {
             'cmd_manage_offline_xacts' : [
                 ['oncommand'],
                 function(event) {
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_OFFLINE_MANAGE_XACTS), {'tab_name' : offlineStrings.getString('menu.cmd_manage_offline_xacts.tab')}, {});
+                    obj.command_tab(event,obj.url_prefix('XUL_OFFLINE_MANAGE_XACTS'), {'tab_name' : offlineStrings.getString('menu.cmd_manage_offline_xacts.tab')}, {});
                 }
             ],
             'cmd_download_patrons' : [
                 ['oncommand'],
                 function() {
                     try {
-                        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                         var x = new XMLHttpRequest();
                         var url = 'http://' + XML_HTTP_SERVER + '/standalone/list.txt';
                         x.open("GET",url,false);
@@ -1314,35 +1336,35 @@ main.menu.prototype = {
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_PATRON_BARCODE_ENTRY), {}, { 'perm_editor' : true });
+                    obj.command_tab(event,obj.url_prefix('XUL_PATRON_BARCODE_ENTRY'), {}, { 'perm_editor' : true });
                 }
             ],
             'cmd_print_list_template_edit' : [
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_PRINT_LIST_TEMPLATE_EDITOR), {}, {});
+                    obj.command_tab(event,obj.url_prefix('XUL_PRINT_LIST_TEMPLATE_EDITOR'), {}, {});
                 }
             ],
             'cmd_stat_cat_edit' : [
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_STAT_CAT_EDIT) + '?ses='+window.escape(ses()), {'tab_name' : offlineStrings.getString('menu.cmd_stat_cat_edit.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_STAT_CAT_EDIT?ses=') + window.escape(ses()), {'tab_name' : offlineStrings.getString('menu.cmd_stat_cat_edit.tab')},{});
                 }
             ],
             'cmd_non_cat_type_edit' : [
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_NON_CAT_LABEL_EDIT) + '?ses='+window.escape(ses()), {'tab_name' : offlineStrings.getString('menu.cmd_non_cat_type_edit.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_NON_CAT_LABEL_EDIT?ses=') + window.escape(ses()), {'tab_name' : offlineStrings.getString('menu.cmd_non_cat_type_edit.tab')},{});
                 }
             ],
             'cmd_copy_location_edit' : [
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_COPY_LOCATION_EDIT) + '?ses='+window.escape(ses()),{'tab_name' : offlineStrings.getString('menu.cmd_copy_location_edit.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_COPY_LOCATION_EDIT?ses=') + window.escape(ses()),{'tab_name' : offlineStrings.getString('menu.cmd_copy_location_edit.tab')},{});
                 }
             ],
             'cmd_test' : [
@@ -1350,59 +1372,59 @@ main.menu.prototype = {
                 function(event) {
                     obj.data.stash_retrieve();
                     var content_params = { 'session' : ses(), 'authtime' : ses('authtime') };
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_OPAC_WRAPPER), {}, content_params);
+                    obj.command_tab(event,obj.url_prefix('XUL_OPAC_WRAPPER'), {}, content_params);
                 }
             ],
             'cmd_test_html' : [
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.TEST_HTML) + '?ses='+window.escape(ses()),{ 'browser' : true },{});
+                    obj.command_tab(event,obj.url_prefix('TEST_HTML?ses=') + window.escape(ses()),{ 'browser' : true },{});
                 }
             ],
             'cmd_test_xul' : [
                 ['oncommand'],
                 function(event) {
                     obj.data.stash_retrieve();
-                    obj.command_tab(event,obj.url_prefix(urls.TEST_XUL) + '?ses='+window.escape(ses()),{ 'browser' : false },{});
+                    obj.command_tab(event,obj.url_prefix('TEST_XUL?ses=') + window.escape(ses()),{ 'browser' : false },{});
                 }
             ],
             'cmd_console' : [
                 ['oncommand'],
                 function(event) {
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_DEBUG_CONSOLE),{'tab_name' : offlineStrings.getString('menu.cmd_console.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_DEBUG_CONSOLE'),{'tab_name' : offlineStrings.getString('menu.cmd_console.tab')},{});
                 }
             ],
             'cmd_shell' : [
                 ['oncommand'],
                 function(event) {
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_DEBUG_SHELL),{'tab_name' : offlineStrings.getString('menu.cmd_shell.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_DEBUG_SHELL'),{'tab_name' : offlineStrings.getString('menu.cmd_shell.tab')},{});
                 }
             ],
             'cmd_xuleditor' : [
                 ['oncommand'],
                 function(event) {
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_DEBUG_XULEDITOR),{'tab_name' : offlineStrings.getString('menu.cmd_xuleditor.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_DEBUG_XULEDITOR'),{'tab_name' : offlineStrings.getString('menu.cmd_xuleditor.tab')},{});
                 }
             ],
             'cmd_fieldmapper' : [
                 ['oncommand'],
                 function(event) {
-                    obj.command_tab(event,obj.url_prefix(urls.XUL_DEBUG_FIELDMAPPER),{'tab_name' : offlineStrings.getString('menu.cmd_fieldmapper.tab')},{});
+                    obj.command_tab(event,obj.url_prefix('XUL_DEBUG_FIELDMAPPER'),{'tab_name' : offlineStrings.getString('menu.cmd_fieldmapper.tab')},{});
                 }
             ],
             'cmd_survey_wizard' : [
                 ['oncommand'],
                 function() {
                     obj.data.stash_retrieve();
-                    xulG.window.open(obj.url_prefix(urls.XUL_SURVEY_WIZARD),'survey_wizard','chrome'); 
+                    xulG.window.open(obj.url_prefix('XUL_SURVEY_WIZARD'),'survey_wizard','chrome'); 
                 }
             ],
             'cmd_public_opac' : [
                 ['oncommand'],
                 function(event) {
                     var loc = urls.XUL_BROWSER + '?url=' + window.escape(
-                        obj.url_prefix(urls.remote)
+                        obj.url_prefix('remote')
                     );
                     obj.command_tab(
                         event,
@@ -1416,7 +1438,6 @@ main.menu.prototype = {
                 ['oncommand'],
                 function clear_the_cache() {
                     try {
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         var cacheClass         = Components.classes["@mozilla.org/network/cache-service;1"];
                         var cacheService    = cacheClass.getService(Components.interfaces.nsICacheService);
                         cacheService.evictEntries(Components.interfaces.nsICache.STORE_ON_DISK);
@@ -1467,7 +1488,6 @@ main.menu.prototype = {
                         obj.data.unsaved_data = 0; // just in case the program doesn't close somehow
                         obj.data.stash('unsaved_data');
                         dump('forcing data.unsaved_data == ' + obj.data.unsaved_data + '\n');
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         var windowManager = Components.classes["@mozilla.org/appshell/window-mediator;1"].getService();
                         var windowManagerInterface = windowManager.QueryInterface(Components.interfaces.nsIWindowMediator);
                         var enumerator = windowManagerInterface.getEnumerator(null);
@@ -1564,7 +1584,7 @@ main.menu.prototype = {
             'cmd_toolbar_configure' : [
                 ['oncommand'],
                 function(event) {
-                    var url = obj.url_prefix( urls.XUL_TOOLBAR_CONFIG ); 
+                    var url = obj.url_prefix( 'XUL_TOOLBAR_CONFIG' ); 
                     obj.command_tab(event,url,{},{});
                 }
             ],
@@ -1907,7 +1927,6 @@ main.menu.prototype = {
             function() {
                 try {
                     tabscroller.ensureElementIsVisible(tab);
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     if (panel
                         && panel.firstChild 
                         && ( panel.firstChild.nodeName == 'iframe' || panel.firstChild.nodeName == 'browser' )
@@ -2167,13 +2186,13 @@ commands:
     'set_patron_tab' : function(params,content_params,event) {
         var obj = this;
         var horizontal_interface = String( obj.data.hash.aous['ui.circ.patron_summary.horizontal'] ) == 'true';
-        var url = obj.url_prefix( horizontal_interface ? urls.XUL_PATRON_HORIZ_DISPLAY : urls.XUL_PATRON_DISPLAY );
+        var url = obj.url_prefix( horizontal_interface ? 'XUL_PATRON_HORIZ_DISPLAY' : 'XUL_PATRON_DISPLAY' );
         obj.command_tab(event,url,params ? params : {},content_params ? content_params : {});
     },
     'new_patron_tab' : function(params,content_params) {
         var obj = this;
         var horizontal_interface = String( obj.data.hash.aous['ui.circ.patron_summary.horizontal'] ) == 'true';
-        var url = obj.url_prefix( horizontal_interface ? urls.XUL_PATRON_HORIZ_DISPLAY : urls.XUL_PATRON_DISPLAY );
+        var url = obj.url_prefix( horizontal_interface ? 'XUL_PATRON_HORIZ_DISPLAY' : 'XUL_PATRON_DISPLAY' );
         obj.new_tab(url,params ? params : {},content_params ? content_params : {});
     },
     'volume_item_creator' : function(params) {
@@ -2182,9 +2201,9 @@ commands:
         var unified_interface = String( obj.data.hash.aous['ui.unified_volume_copy_editor'] ) == 'true';
         if (unified_interface) {
             var horizontal_interface = String( obj.data.hash.aous['ui.cat.volume_copy_editor.horizontal'] ) == 'true';
-            url = obj.url_prefix( horizontal_interface ? urls.XUL_VOLUME_COPY_CREATOR_HORIZONTAL : urls.XUL_VOLUME_COPY_CREATOR );
+            url = obj.url_prefix( horizontal_interface ? 'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : 'XUL_VOLUME_COPY_CREATOR' );
         } else {
-            url = obj.url_prefix( urls.XUL_VOLUME_COPY_CREATOR_ORIGINAL );
+            url = obj.url_prefix('XUL_VOLUME_COPY_CREATOR_ORIGINAL');
         }
         var w = obj.new_tab(
             url,
@@ -2200,7 +2219,7 @@ commands:
         if (docid) {
             content_params['docid'] = docid;
         }
-        var url = obj.url_prefix( urls.XUL_COPY_VOLUME_BROWSE );
+        var url = obj.url_prefix('XUL_COPY_VOLUME_BROWSE');
         obj.new_tab(url,params || {}, content_params);
     },
     'get_new_session' : function(params) {
@@ -2232,7 +2251,7 @@ commands:
 
     'set_tab' : function(url,params,content_params) {
         var obj = this;
-        if (!url) url = '/xul/server/';
+        if (!url) url = 'oils://remote/xul/server/';
         if (!url.match(/:\/\//) && !url.match(/^data:/)) url = urls.remote + url;
         if (!params) params = {};
         if (!content_params) content_params = {};
@@ -2367,7 +2386,6 @@ commands:
                 dump('creating iframe with src = ' + url + '\n');
                 frame.setAttribute('src',url);
                 try {
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     var cw = frame.contentWindow;
                     if (typeof cw.wrappedJSObject != 'undefined') cw = cw.wrappedJSObject;
                     cw.IAMXUL = true;
@@ -2414,7 +2432,6 @@ commands:
     },
 
     'open_external' : function(url) {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         // first construct an nsIURI object using the ioservice
         var ioservice = Components.classes["@mozilla.org/network/io-service;1"]
                             .getService(Components.interfaces.nsIIOService);
@@ -2514,7 +2531,7 @@ commands:
         if(!xulG.url_prefix) xulG.url_prefix = url_prefix; // Make util.window happy
         JSAN.use('util.window');
         var win = new util.window();
-        var url = url_prefix(urls.XUL_FANCY_PROMPT);
+        var url = url_prefix('XUL_FANCY_PROMPT');
         var title = offlineStrings.getString('barcode_choice.title');
         var xml = '<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" flex="1">';
         xml += '<groupbox flex="1" style="overflow: auto; border: solid thin;"><caption label="' + title + '"/>';
diff --git a/Open-ILS/xul/staff_client/chrome/content/main/menu_frame.xul b/Open-ILS/xul/staff_client/chrome/content/main/menu_frame.xul
index e87e371..e2f4ed9 100644
--- a/Open-ILS/xul/staff_client/chrome/content/main/menu_frame.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/main/menu_frame.xul
@@ -72,7 +72,6 @@
         function my_init() {
             try {
 
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw(document.getElementById('offlineStrings').getString('common.jsan.missing')); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 /*
diff --git a/Open-ILS/xul/staff_client/chrome/content/main/menu_frame_menus.xul b/Open-ILS/xul/staff_client/chrome/content/main/menu_frame_menus.xul
index 836d2b3..54bd6bb 100644
--- a/Open-ILS/xul/staff_client/chrome/content/main/menu_frame_menus.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/main/menu_frame_menus.xul
@@ -631,7 +631,7 @@
                 <menuitem label="&staff.main.menu.admin.venkman.label;" command="cmd_debug_venkman"/>
                 <menuitem label="&staff.main.auth.debug.inspector;" command="cmd_debug_inspector"/>
                 <menuitem label="&staff.main.auth.debug.chrome_list;" command="cmd_debug_chrome_list"/>
-                <menuitem label="&staff.main.menu.admin.ping;" oncommand="try{netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');JSAN.use('util.network'); var n = new util.network(); alert(n.ping());}catch(E){alert(E);}"/>
+                <menuitem label="&staff.main.menu.admin.ping;" oncommand="try{JSAN.use('util.network'); var n = new util.network(); alert(n.ping());}catch(E){alert(E);}"/>
             </menupopup>
         </menu>
     </menupopup>
diff --git a/Open-ILS/xul/staff_client/chrome/content/main/simple_auth.xul b/Open-ILS/xul/staff_client/chrome/content/main/simple_auth.xul
index 0d63ae1..89b5440 100644
--- a/Open-ILS/xul/staff_client/chrome/content/main/simple_auth.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/main/simple_auth.xul
@@ -34,7 +34,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { 
                     throw( offlineStrings.getString('common.jsan.missing'));
                 }
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/browser.js b/Open-ILS/xul/staff_client/chrome/content/util/browser.js
index 88c0fe3..fb0078a 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/browser.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/browser.js
@@ -3,7 +3,6 @@ dump('entering util.browser.js\n');
 if (typeof util == 'undefined') util = {};
 util.browser = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
     } catch(E) {
         dump('util.browser: ' + E + '\n');
@@ -20,8 +19,6 @@ util.browser.prototype = {
     'init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
             var obj = this;
 
             obj.url = params['url'];
@@ -61,7 +58,6 @@ util.browser.prototype = {
                             ['command'],
                             function() {
                                 try {
-                                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                     var content = obj.get_content();
                                     JSAN.use('util.print'); var p = new util.print(obj.printer_context);
                                     var print_params = {};
@@ -103,7 +99,6 @@ util.browser.prototype = {
                             ['command'],
                             function() {
                                 try {
-                                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                     var n = obj.getWebNavigation();
                                     if (n.canGoForward) n.goForward();
                                 } catch(E) {
@@ -116,7 +111,6 @@ util.browser.prototype = {
                             ['command'],
                             function() {
                                 try {
-                                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                     var n = obj.getWebNavigation();
                                     if (n.canGoBack) {
                                         obj.back_button_clicked = true;
@@ -182,7 +176,6 @@ util.browser.prototype = {
                 return;
             }
         }
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var n = obj.getWebNavigation();
         n.reload( Components.interfaces.nsIWebNavigation.LOAD_FLAGS_NONE );
     },
@@ -190,8 +183,6 @@ util.browser.prototype = {
     'find' : function(text) {
         var obj = this;
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
             function getBrowser() {
                 return obj.controller.view.browser_browser;
             }
@@ -254,7 +245,6 @@ util.browser.prototype = {
 
     'get_content' : function() {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (this.controller.view.browser_browser.contentWindow.wrappedJSObject) {
                 return this.controller.view.browser_browser.contentWindow.wrappedJSObject;
             } else {
@@ -271,7 +261,6 @@ util.browser.prototype = {
             var s = '';
             try { s += obj.url + '\n' + obj.get_content().location.href + '\n'; } catch(E) { s+=E + '\n'; }
             if (!obj.push_xulG) return;
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var cw = this.get_content();
             cw.IAMXUL = true;
             cw.XUL_BUILD_ID = '/xul/server/'.split(/\//)[2];
@@ -310,7 +299,6 @@ util.browser.prototype = {
 
     'getWebNavigation' : function() {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var wn = this.controller.view.browser_browser.webNavigation;
             var s = this.url + '\n' + this.get_content().location.href + '\n';
             s += ('getWebNavigation() = ' + wn + '\n');
@@ -322,7 +310,6 @@ util.browser.prototype = {
     },
 
     'updateNavButtons' : function() {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var obj = this; 
         var s = obj.url + '\n' + obj.get_content().location.href + '\n';
         try {
@@ -385,8 +372,6 @@ util.browser.prototype = {
     'buildProgressListener' : function() {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
             var obj = this;
             obj.progressListener = {
                 onProgressChange    : function(webProgress,request,curSelfProgress,maxSelfProgress,curTotalProgress,maxTotalProgress){
@@ -435,7 +420,6 @@ util.browser.prototype = {
                 },
                 onStateChange         : function ( webProgress, request, stateFlags, status) {
                     try {
-                        netscape.security.PrivilegeManager.enablePrivilege( "UniversalXPConnect" );
                         /*dump('browser.js onStateChange('
                             +webProgress
                             +','+request
@@ -491,11 +475,9 @@ util.browser.prototype = {
                                         obj.error.sdump('D_TRACE','calling on_url_load');
                                         var helpers = {
                                             'doc_write' : function(html) {
-                                                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                                 obj.get_content().document.write(html);
                                             },
                                             'doc_close' : function() {
-                                                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                                 obj.get_content().document.close();
                                             }
                                         }
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/browser.xul b/Open-ILS/xul/staff_client/chrome/content/util/browser.xul
index d5df55d..4356f62 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/browser.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/util/browser.xul
@@ -23,7 +23,6 @@
     <!-- BEHAVIOR -->
         <script type="text/javascript">
         var myPackageDir = 'open_ils_staff_client'; var IAMXUL = true; var g = {};
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     </script>
         <scripts id="openils_util_scripts"/>
 
@@ -32,7 +31,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('..');
@@ -115,11 +113,11 @@
     </commandset>
 
     <popupset>
-        <popup id="debug_popup">
+        <menupopup id="debug_popup">
             <menuitem label="&common.browser.view_source.label;" accesskey="&common.browser.view_source.accesskey;" command="cmd_view_source" />
             <menuitem label="&common.browser.set_url.label;" accesskey="&common.browser.set_url.accesskey;" command="cmd_debug" />
             <menuitem label="&common.browser.find.label;" accesskey="&common.browser.find.accesskey;" command="cmd_find" />
-        </popup>
+        </menupopup>
     </popupset>
 
     <vbox flex="1">
@@ -131,7 +129,7 @@
             <label id="debug" value="Debug" disabled="true" popup="debug_popup" />
             <button id="browser_print" command="cmd_print" hidden="true"/>
         </hbox>
-        <browser id="browser_browser" flex="1" autoscroll="false" type="content"/>
+        <browser id="browser_browser" flex="1" autoscroll="false" type="content" oils_force_external="true" />
     </vbox>
 
 </window>
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/clipboard.js b/Open-ILS/xul/staff_client/chrome/content/util/clipboard.js
index e03b3e3..75d225a 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/clipboard.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/clipboard.js
@@ -10,7 +10,6 @@ util.clipboard.EXPORT_TAGS    = { ':all' : util.clipboard.EXPORT_OK };
 
 util.clipboard.cut = function() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
         var n = document.popupNode;
         if (n.getAttribute('readonly')=='true') return;
         var v = n.value;
@@ -30,7 +29,6 @@ util.clipboard.cut = function() {
 
 util.clipboard.copy = function() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
         var n = document.popupNode;
         var v = n.value;
         var start = n.selectionStart;
@@ -47,7 +45,6 @@ util.clipboard.copy = function() {
 
 util.clipboard.paste = function() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
         var n = document.popupNode;
         if (n.getAttribute('readonly')=='true') return;
         var v = n.value;
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/deck.js b/Open-ILS/xul/staff_client/chrome/content/util/deck.js
index 6b3aaad..aa0557d 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/deck.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/deck.js
@@ -54,7 +54,6 @@ util.deck.prototype = {
 
             if (content_params) {
                 try {
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     this.error.sdump('D_DECK', 'set_iframe\nurl = ' + url + '\nframe.contentWindow = ' + iframe.contentWindow + '\n' + 'content_params = ' + (content_params) );
                     var cw = iframe.contentWindow; 
                     if (typeof iframe.contentWindow.wrappedJSObject != 'undefined') cw = iframe.contentWindow.wrappedJSObject;
@@ -90,7 +89,6 @@ util.deck.prototype = {
         this.node.selectedIndex = this.node.childNodes.length - 1;
         if (content_params) {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 this.error.sdump('D_DECK', 'new_iframe\nurl = ' + url + '\nframe.contentWindow = ' + iframe.contentWindow + '\n' + 'content_params = ' + (content_params) );
                 var cw = iframe.contentWindow; 
                 if (typeof iframe.contentWindow.wrappedJSObject != 'undefined') cw = iframe.contentWindow.wrappedJSObject;
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/error.js b/Open-ILS/xul/staff_client/chrome/content/util/error.js
index 5ced634..f30605a 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/error.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/error.js
@@ -6,7 +6,6 @@ util.error = function () {
     try {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             this.consoleService = Components.classes['@mozilla.org/consoleservice;1']
                 .getService(Components.interfaces.nsIConsoleService);
         } catch(E) {
@@ -174,7 +173,6 @@ util.error.prototype = {
                 if (this.forceDebugDump || ( this.allowDebugDump && this.sdump_levels[level] && this.sdump_levels[level].debug ) ) this.debug(message);
                 if (this.forceAlertDump || ( this.allowAlertDump && this.sdump_levels[level] && this.sdump_levels[level].alert ) ) alert(message);
                 if (this.forceConsoleDump || ( this.allowConsoleDump && this.sdump_levels[level] && this.sdump_levels[level].console ) ) {
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     if (level=='D_ERROR') {
                         Components.utils.reportError(message);
                     } else {
@@ -183,7 +181,6 @@ util.error.prototype = {
                 }
                 if (this.forceFileDump || ( this.allowFileDump && this.sdump_levels[level] && this.sdump_levels[level].file ) ) {
                     if (level!='D_FILE') {
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         JSAN.use('util.file'); var master_log = new util.file('log');
                         master_log.write_content('append',message); master_log.close();
                         var specific_log = new util.file('log_'+level);
@@ -349,7 +346,6 @@ util.error.prototype = {
         */
 
         dump('yns_alert:\n\ts = ' + s + '\n\ttitle = ' + title + '\n\tb1 = ' + b1 + '\n\tb2 = ' + b2 + '\n\tb3 = ' + b3 + '\n\tc = ' + c + '\n');
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalBrowserWrite");
 
         //FIXME - is that good enough of an escape job?
         s = s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
@@ -423,7 +419,6 @@ util.error.prototype = {
         */
 
         dump('yns_alert_formatted:\n\ts = ' + s + '\n\ttitle = ' + title + '\n\tb1 = ' + b1 + '\n\tb2 = ' + b2 + '\n\tb3 = ' + b3 + '\n\tc = ' + c + '\n');
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalBrowserWrite");
 
         //FIXME - is that good enough of an escape job?
         s = s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
@@ -489,7 +484,6 @@ util.error.prototype = {
         */
 
         dump('yns_alert_original:\n\ts = ' + s + '\n\ttitle = ' + title + '\n\tb1 = ' + b1 + '\n\tb2 = ' + b2 + '\n\tb3 = ' + b3 + '\n\tc = ' + c + '\n');
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 
         if (this.sound) { this.sound.bad(); }
 
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/fancy_prompt.xul b/Open-ILS/xul/staff_client/chrome/content/util/fancy_prompt.xul
index e66dded..281ee63 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/fancy_prompt.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/util/fancy_prompt.xul
@@ -38,7 +38,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/file.js b/Open-ILS/xul/staff_client/chrome/content/util/file.js
index 48b5e59..bc696dd 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/file.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/file.js
@@ -3,8 +3,6 @@ dump('entering util/file.js\n');
 if (typeof util == 'undefined') util = {};
 util.file = function (fname) {
 
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalPreferencesWrite UniversalBrowserWrite UniversalPreferencesRead UniversalBrowserRead UniversalFileRead");
-
     JSAN.use('util.error'); this.error = new util.error();
 
     this.dirService = Components.classes["@mozilla.org/file/directory_service;1"].
@@ -30,7 +28,6 @@ util.file.prototype = {
             if (!fname) throw('Must specify a filename.');
 
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalPreferencesWrite UniversalBrowserWrite UniversalPreferencesRead UniversalBrowserRead UniversalFileRead");
                 var pref = Components.classes["@mozilla.org/preferences-service;1"]
                     .getService(Components.interfaces.nsIPrefBranch);
                 if (!path && pref.getBoolPref("open-ils.write_in_user_chrome_directory")) path = 'uchrome';
@@ -44,10 +41,6 @@ util.file.prototype = {
                     this._file = this.dirService.get( "UChrm",  Components.interfaces.nsIFile );
                     //this._file = this.dirService.get( "ProfD",  Components.interfaces.nsIFile );
                 break;
-                case 'skin' :
-                    this._file = this.dirService.get( "AChrom",  Components.interfaces.nsIFile );
-                    this._file.append("skin");
-                break;
                 default:
                 case 'chrome' : 
                     this._file = this.dirService.get( "AChrom",  Components.interfaces.nsIFile );
@@ -120,7 +113,6 @@ util.file.prototype = {
 
     'write_content' : function(write_type,content) {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalPreferencesWrite UniversalBrowserWrite UniversalPreferencesRead UniversalBrowserRead UniversalFileRead");
             if (!this._output_stream) this._create_output_stream(write_type);
             this._output_stream.write( content, String( content ).length );
         } catch(E) {
@@ -144,8 +136,6 @@ util.file.prototype = {
 
     'get_content' : function() {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalPreferencesWrite UniversalBrowserWrite UniversalPreferencesRead UniversalBrowserRead UniversalFileRead");
-
             if (!this._file) throw('Must .get() a file first.');
             if (!this._file.exists()) throw('File does not exist.');
             
@@ -163,8 +153,6 @@ util.file.prototype = {
         try {
             //dump('_create_input_stream()\n');
             
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalPreferencesWrite UniversalBrowserWrite UniversalPreferencesRead UniversalBrowserRead UniversalFileRead");
-
             if (!this._file) throw('Must .get() a file first.');
             if (!this._file.exists()) throw('File does not exist.');
 
@@ -194,8 +182,6 @@ util.file.prototype = {
         try {
             //dump('_create_output_stream('+param+') for '+this._file.path+'\n');
             
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalPreferencesWrite UniversalBrowserWrite UniversalPreferencesRead UniversalBrowserRead UniversalFileRead");
-
             if (!this._file) throw('Must .get() a file first.');
 
             if (! this._file.exists()) {
@@ -230,7 +216,6 @@ util.file.prototype = {
 
     'pick_file' : function(params) {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (typeof params == 'undefined') params = {};
             if (typeof params.mode == 'undefined') params.mode = 'open';
             var nsIFilePicker = Components.interfaces.nsIFilePicker;
@@ -261,7 +246,6 @@ util.file.prototype = {
             if (typeof params == 'undefined') params = {};
             params.mode = 'save';
             if (typeof params.data == 'undefined') throw('Need a .data field to export');
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var f = obj.pick_file( params );
             if (f) {
                 obj._file = f;
@@ -289,7 +273,6 @@ util.file.prototype = {
             var obj = this;
             if (typeof params == 'undefined') params = {};
             params.mode = 'open';
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var f = obj.pick_file(params);
             if (f && f.exists()) {
                 obj._file = f;
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/fm_view.xul b/Open-ILS/xul/staff_client/chrome/content/util/fm_view.xul
index e75d08b..9b3792c 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/fm_view.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/util/fm_view.xul
@@ -53,7 +53,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/list.js b/Open-ILS/xul/staff_client/chrome/content/util/list.js
index b17e9b2..9b37385 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/list.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/list.js
@@ -407,7 +407,6 @@ util.list.prototype = {
                 var col_ordinal = col.getAttribute('ordinal'); 
                 my_cols[ col_id ] = { 'hidden' : col_hidden, 'width' : col_width, 'ordinal' : col_ordinal };
             }
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             JSAN.use('util.file'); var file = new util.file('tree_columns_for_'+window.escape(id));
             file.set_object(my_cols);
             file.close();
@@ -438,7 +437,6 @@ util.list.prototype = {
             var my_cols;
             if (! obj.data.hash.aous) { obj.data.hash.aous = {}; }
             if (! obj.data.hash.aous['gui.disable_local_save_columns']) {
-                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                 JSAN.use('util.file'); var file = new util.file('tree_columns_for_'+window.escape(id));
                 if (file._file.exists()) {
                     my_cols = file.get_object(); file.close();
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/list_clipboard.xul b/Open-ILS/xul/staff_client/chrome/content/util/list_clipboard.xul
index 45aa595..f8f2f38 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/list_clipboard.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/util/list_clipboard.xul
@@ -39,7 +39,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/mozilla.js b/Open-ILS/xul/staff_client/chrome/content/util/mozilla.js
index 5ae387b..a5cbe8c 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/mozilla.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/mozilla.js
@@ -1,6 +1,5 @@
 dump('entering util/mozilla.js\n');
 
-netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 const Cc = Components.classes;
 const Ci = Components.interfaces;
 
@@ -15,7 +14,6 @@ util.mozilla.EXPORT_TAGS    = { ':all' : util.mozilla.EXPORT_OK };
 util.mozilla.chromeRegistry = function() {
     try {
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         return Cc['@mozilla.org/chrome/chrome-registry;1'].getService(Ci['nsIToolkitChromeRegistry']);
 
     } catch(E) {
@@ -26,7 +24,6 @@ util.mozilla.chromeRegistry = function() {
 util.mozilla.languages = function() {
     try {
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var stringBundles = Cc['@mozilla.org/intl/stringbundle;1'].getService(Ci['nsIStringBundleService']);
         return stringBundles.createBundle('chrome://global/locale/languageNames.properties');
 
@@ -38,7 +35,6 @@ util.mozilla.languages = function() {
 util.mozilla.regions = function() {
     try {
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var stringBundles = Cc['@mozilla.org/intl/stringbundle;1'].getService(Ci['nsIStringBundleService']);
         return stringBundles.createBundle('chrome://global/locale/regionNames.properties');
 
@@ -50,7 +46,6 @@ util.mozilla.regions = function() {
 util.mozilla.prefs = function() {
     try {
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         return Cc['@mozilla.org/preferences-service;1'].getService(Ci['nsIPrefBranch']);
 
     } catch(E) {
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/network.js b/Open-ILS/xul/staff_client/chrome/content/util/network.js
index fc2b5a6..e999028 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/network.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/network.js
@@ -327,7 +327,7 @@ util.network.prototype = {
             while ( w = enumerator.getNext() ) {
                 x = w.document.getElementById('oc_menuitem');
 
-                if(!offlinestrings) w.document.getElementById('offlineStrings');
+                if(!offlinestrings) offlinestrings = w.document.getElementById('offlineStrings');
                 if(permlist) w.g.menu.set_menu_access(permlist);
                 if(data.list.au.length > 1) {
                     addCSSClass(w.document.getElementById('main_tabbox'),'operator_change');
@@ -347,7 +347,6 @@ util.network.prototype = {
         var obj = this;
         try {
 
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
         var url = urls.XUL_AUTH_SIMPLE;
         if (typeof xulG != 'undefined' && typeof xulG.url_prefix == 'function') url = xulG.url_prefix( url );
         JSAN.use('util.window'); var win = new util.window();
@@ -374,12 +373,10 @@ util.network.prototype = {
             data.stash('session');
             try {
                 var ios = Components.classes["@mozilla.org/network/io-service;1"].getService(Components.interfaces.nsIIOService);
-                var cookieUri = ios.newURI("http://" + data.server_unadorned, null, null);
                 var cookieUriSSL = ios.newURI("https://" + data.server_unadorned, null, null);
                 var cookieSvc = Components.classes["@mozilla.org/cookieService;1"].getService(Components.interfaces.nsICookieService);
 
-                cookieSvc.setCookieString(cookieUri, null, "ses="+data.session.key, null);
-                cookieSvc.setCookieString(cookieUriSSL, null, "ses="+data.session.key, null);
+                cookieSvc.setCookieString(cookieUriSSL, null, "ses="+data.session.key + "; secure;", null);
 
             } catch(E) {
                 alert(offineStrings.getFormattedString('main.session_cookie.error', [E]));
@@ -422,7 +419,6 @@ util.network.prototype = {
             var obj = this;
             var robj = obj.get_result(req);
             if (robj != null && robj.ilsevent && robj.ilsevent == 5000) {
-                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                 if (location.href.match(/^chrome/)) {
                     //alert('Permission denied.');
                 } else {
@@ -489,7 +485,6 @@ util.network.prototype = {
                         return req;
                     }
 
-                    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                     var xml = '<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">' + 
                         '<groupbox><caption label="' + offlineStrings.getString('network.override.exceptions') + '"/>' + 
                         '<grid><columns><column/><column flex="1"/></columns><rows>';
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/print.js b/Open-ILS/xul/staff_client/chrome/content/util/print.js
index 166b486..c3ff12b 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/print.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/print.js
@@ -3,8 +3,6 @@ dump('entering util/print.js\n');
 if (typeof util == 'undefined') util = {};
 util.print = function (context) {
 
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
     JSAN.use('util.error'); this.error = new util.error();
     JSAN.use('OpenILS.data'); this.data = new OpenILS.data(); this.data.init( { 'via':'stash' } );
     JSAN.use('util.window'); this.win = new util.window();
@@ -31,8 +29,6 @@ util.print = function (context) {
 util.print.prototype = {
 
     'set_context' : function(context, set_default) {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
         this.context = context || 'default';
         if(set_default) this.default_context = this.context;
     
@@ -136,7 +132,6 @@ util.print.prototype = {
 
             var w;
 
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             obj.data.init({'via':'stash'});
 
             if (typeof obj.data.print_strategy == 'undefined') {
@@ -472,7 +467,6 @@ util.print.prototype = {
         try {
             if (!params) params = {};
 
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             obj.data.init({'via':'stash'});
 
             if (params.print_strategy || obj.data.print_strategy[obj.context] || obj.data.print_strategy['default']) {
@@ -493,7 +487,6 @@ util.print.prototype = {
                                 w = obj.html2txt(temp_w);
                             } catch(E) {
                                 dump('util.print: Could not use w.document.firstChild.innerHTML with ' + w + ': ' + E + '\n');
-                                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                 w.getSelection().selectAllChildren(w.document.firstChild);
                                 w = w.getSelection().toString();
                             }
@@ -501,7 +494,6 @@ util.print.prototype = {
                         obj._NSPrint_custom_print(w,silent,params);
                     break;    
                     case 'window.print':
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         var prefs = Components.classes['@mozilla.org/preferences-service;1'].getService(Components.interfaces['nsIPrefBranch']);
                         var originalPrinter = false;
                         if (prefs.prefHasUserValue('print.print_printer')) {
@@ -619,7 +611,6 @@ util.print.prototype = {
     '_NSPrint_webBrowserPrint' : function(w,silent,params) {
         var obj = this;
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var webBrowserPrint = w
                 .QueryInterface(Components.interfaces.nsIInterfaceRequestor)
                 .getInterface(Components.interfaces.nsIWebBrowserPrint);
@@ -648,7 +639,6 @@ util.print.prototype = {
     'GetPrintSettings' : function() {
         try {
             //alert('entering GetPrintSettings');
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var pref = Components.classes["@mozilla.org/preferences-service;1"]
                 .getService(Components.interfaces.nsIPrefBranch);
             //alert('pref = ' + pref);
@@ -678,7 +668,6 @@ util.print.prototype = {
 
     'setPrinterDefaultsForSelectedPrinter' : function (aPrintService) {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (this.gPrintSettings.printerName == "") {
                 this.gPrintSettings.printerName = aPrintService.defaultPrinterName;
                 //alert('used .defaultPrinterName');
@@ -701,7 +690,6 @@ util.print.prototype = {
 
     'page_settings' : function() {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             this.GetPrintSettings();
             var PO = Components.classes["@mozilla.org/gfx/printsettings-service;1"].getService(Components.interfaces.nsIPrintOptions);
             PO.ShowPrintSetupDialog(this.gPrintSettings);
@@ -713,7 +701,6 @@ util.print.prototype = {
     'load_settings' : function() {
         try {
             var error_msg = '';
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var file = new util.file('gPrintSettings.' + this.context);
             if (file._file.exists()) {
                 temp = file.get_object(); file.close();
@@ -759,7 +746,6 @@ util.print.prototype = {
     'save_settings' : function() {
         try {
             var obj = this;
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var file = new util.file('gPrintSettings.' + this.context);
             if (typeof obj.gPrintSettings == 'undefined') obj.GetPrintSettings();
             if (obj.gPrintSettings) file.set_object(obj.gPrintSettings); 
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/rbrowser.xul b/Open-ILS/xul/staff_client/chrome/content/util/rbrowser.xul
index 1f0983c..353889a 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/rbrowser.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/util/rbrowser.xul
@@ -26,7 +26,6 @@
     <!-- BEHAVIOR -->
         <script type="text/javascript">
         var myPackageDir = 'open_ils_staff_client'; var IAMXUL = true; var g = {};
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     </script>
         <scripts id="openils_util_scripts"/>
 
@@ -36,7 +35,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -122,11 +120,11 @@
     </commandset>
 
     <popupset>
-        <popup id="debug_popup">
+        <menupopup id="debug_popup">
             <menuitem label="&common.browser.view_source.label;" accesskey="&common.browser.view_source.accesskey;" command="cmd_view_source" />
             <menuitem label="&common.browser.set_url.label;" accesskey="&common.browser.set_url.accesskey;" command="cmd_debug" />
             <menuitem label="&common.browser.find.label;" accesskey="&common.browser.find.accesskey;" command="cmd_find" />
-        </popup>
+        </menupopup>
     </popupset>
 
     <vbox flex="1">
@@ -138,7 +136,7 @@
             <label id="debug" value="Debug" disabled="true" popup="debug_popup" />
             <button id="browser_print" command="cmd_print" hidden="true"/>
         </hbox>
-        <browser id="browser_browser" flex="1" autoscroll="false" type="content"/>
+        <browser id="browser_browser" flex="1" autoscroll="false" type="content" oils_force_external="true" />
     </vbox>
 
 </window>
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/shell.js b/Open-ILS/xul/staff_client/chrome/content/util/shell.js
index 7dda6e3..747d059 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/shell.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/shell.js
@@ -11,7 +11,6 @@ lastError = null;
 
 function win_list() {
     var list = [];
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"].
         getService(Components.interfaces.nsIWindowMediator);
     var enumerator = wm.getEnumerator('eg_menu');
@@ -35,7 +34,6 @@ function get_tab(a,b) {
         idx = b;
     }
 
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     var tabs = win.document.getElementById('main_tabs');
     var panels = win.document.getElementById('main_panels');
     return { 'name' : tabs.childNodes[idx].getAttribute('label'), 'content' : panels.childNodes[idx].firstChild.contentWindow };
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/sound.js b/Open-ILS/xul/staff_client/chrome/content/util/sound.js
index 0d57f84..f576eaf 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/sound.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/sound.js
@@ -37,7 +37,6 @@ util.sound = function (params) {
             dump('SOUND('+this.sig+'): starting timer with intervalId = ' + intervalId + '\n');
         }
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var SOUNDContractID = "@mozilla.org/sound;1";
         var SOUNDIID        = Components.interfaces.nsISound;
         this.SOUND          = Components.classes[SOUNDContractID].createInstance(SOUNDIID);
@@ -58,7 +57,6 @@ util.sound.prototype = {
 
     'xp_url_init' : function (aURL) {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var URLContractID   = "@mozilla.org/network/standard-url;1";
             var URLIID          = Components.classes[URLContractID].createInstance( );
             var URL             = URLIID.QueryInterface(Components.interfaces.nsIURL);
@@ -77,7 +75,6 @@ util.sound.prototype = {
 
         var obj = this;
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             JSAN.use('OpenILS.data'); var data = new OpenILS.data(); data.init({'via':'stash'});
             var url2 = obj.xp_url_init( data.server + url );
             if (typeof data.no_sound == 'undefined' || data.no_sound == false || data.no_sound == 'false') {
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/widget_prompt.js b/Open-ILS/xul/staff_client/chrome/content/util/widget_prompt.js
index c51689b..35e5319 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/widget_prompt.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/widget_prompt.js
@@ -3,7 +3,6 @@ var widget;
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/widgets.js b/Open-ILS/xul/staff_client/chrome/content/util/widgets.js
index bf8b644..e0de11d 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/widgets.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/widgets.js
@@ -50,8 +50,6 @@ util.widgets.apply = function(e,attr,attr_value,f) {
 
 util.widgets.save_xml = function (filename,node) {
     try { 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
         JSAN.use('util.file'); var file = new util.file(filename);
 
         node = util.widgets.get(node);
@@ -380,7 +378,6 @@ util.widgets.save_attributes = function (file,ids_attrs) {
                 dump('\telement_id = ' + element_id + '\n');
             }
         }
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         //FIXME - WHY DOES THIS NOT WORK?// JSAN.use('util.file'); var file = new util.file(filename);
         file.set_object(blob); file.close();
     } catch(E) {
@@ -390,7 +387,6 @@ util.widgets.save_attributes = function (file,ids_attrs) {
 
 util.widgets.load_attributes = function (file) {        
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         //FIXME - WHY DOES THIS NOT WORK?// JSAN.use('util.file'); var file = new util.file(filename);
         if (file._file.exists()) {
             var blob = file.get_object(); file.close();
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/window.js b/Open-ILS/xul/staff_client/chrome/content/util/window.js
index dbacd79..ddb8cbc 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/window.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/window.js
@@ -35,12 +35,6 @@ util.window.prototype = {
     'SafeWindowOpen' : function (url,title,features) {
         var w;
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesRead");
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesWrite");
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead");
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserWrite");
-
         const CI = Components.interfaces;
         const PB = Components.classes["@mozilla.org/preferences-service;1"].getService(CI.nsIPrefBranch);
 
@@ -62,12 +56,6 @@ util.window.prototype = {
     'SafeWindowOpenDialog' : function (url,title,features) {
         var w;
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesRead");
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesWrite");
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead");
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserWrite");
-
         const CI = Components.interfaces;
         const PB = Components.classes["@mozilla.org/preferences-service;1"].getService(CI.nsIPrefBranch);
 
@@ -87,7 +75,6 @@ util.window.prototype = {
     },
 
     'open' : function(url,title,features,my_xulG) {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var key;
         if (!title) title = '_blank';
         if (!features) features = 'chrome';
@@ -105,6 +92,9 @@ util.window.prototype = {
             } else if (typeof url_prefix == 'function') {
                     key = key.replace( url_prefix('/'), '/' );    
             }
+            // oils://remote/ looks like http://server/ to files loaded off of it. That is, location.pathname ignores it.
+            // So remove it here, like we remove url_prefix.
+            key = key.replace('oils://remote/', '/');
             if (typeof data.modal_xulG_stack[key] == 'undefined') data.modal_xulG_stack[key] = [];
             data.modal_xulG_stack[key].push( my_xulG );
             data.stash('modal_xulG_stack');
@@ -138,7 +128,6 @@ util.window.prototype = {
     },
 
     'openDialog' : function(url,title,features,my_xulG) {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var key;
         if (!title) title = '_blank';
         if (!features) features = 'chrome'; // Note that this is a default for openDialog anyway
@@ -158,6 +147,9 @@ util.window.prototype = {
             } else if (typeof url_prefix == 'function') {
                     key = key.replace( url_prefix('/'), '/' );    
             }
+            // oils://remote/ looks like http://server/ to files loaded off of it. That is, location.pathname ignores it.
+            // So remove it here, like we remove url_prefix.
+            key = key.replace('oils://remote/', '/');
             if (typeof data.modal_xulG_stack[key] == 'undefined') data.modal_xulG_stack[key] = [];
             data.modal_xulG_stack[key].push( my_xulG );
             data.stash('modal_xulG_stack');
diff --git a/Open-ILS/xul/staff_client/chrome/content/util/xuledit.xul b/Open-ILS/xul/staff_client/chrome/content/util/xuledit.xul
index 8057b3f..e0d2199 100644
--- a/Open-ILS/xul/staff_client/chrome/content/util/xuledit.xul
+++ b/Open-ILS/xul/staff_client/chrome/content/util/xuledit.xul
@@ -9,7 +9,7 @@ onload="try { init(); } catch(E) { dump(E+'\n'); alert(E); }">
 <textbox id="ta" multiline="true" wrap="true" flex="1" onkeydown="resetTimeout()"
 value='&lt;?xml version="1.0"?&gt;&#x0A;&lt;?xml-stylesheet href="chrome://global/skin/" type="text/css"?&gt;&#x0A;&lt;window id="yourwindow" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"&gt;&#x0A;&lt;label value="Put your XUL here!"/&gt;&#x0A;&lt;/window&gt;'/>
 <splitter id="split"/>
-<iframe id="content" src="about:blank" flex="1"/>
+<iframe id="content" src="about:blank" flex="1" oils_force_external="true"/>
 <hbox><button id="open" label="Open preview in new window" onclick="openwin()"/><spacer flex="1"/></hbox>
 </vbox>
 </window>
diff --git a/Open-ILS/xul/staff_client/chrome/inspector.jar b/Open-ILS/xul/staff_client/chrome/inspector.jar
deleted file mode 100644
index f5068c1..0000000
Binary files a/Open-ILS/xul/staff_client/chrome/inspector.jar and /dev/null differ
diff --git a/Open-ILS/xul/staff_client/chrome/skin/global.css b/Open-ILS/xul/staff_client/chrome/skin/global.css
index b0a7593..85e3d1f 100644
--- a/Open-ILS/xul/staff_client/chrome/skin/global.css
+++ b/Open-ILS/xul/staff_client/chrome/skin/global.css
@@ -2,8 +2,6 @@
 @namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"); 
 @namespace html url("http://www.w3.org/TR/REC-html40"); 
 
-window:not([active="true"]) menubar > menu { color: menutext !important }
-
 *|textarea:focus { background-color: #DDFFDD; }
 *|input:focus { background-color: #DDFFDD; }
 
diff --git a/Open-ILS/xul/staff_client/chrome/venkman.jar b/Open-ILS/xul/staff_client/chrome/venkman.jar
deleted file mode 100644
index 29c9500..0000000
Binary files a/Open-ILS/xul/staff_client/chrome/venkman.jar and /dev/null differ
diff --git a/Open-ILS/xul/staff_client/components/clh.js b/Open-ILS/xul/staff_client/components/clh.js
index 9ef48f3..89510c1 100644
--- a/Open-ILS/xul/staff_client/components/clh.js
+++ b/Open-ILS/xul/staff_client/components/clh.js
@@ -1,27 +1,16 @@
-const nsISupports           = Components.interfaces.nsISupports;
-const nsICategoryManager    = Components.interfaces.nsICategoryManager;
-const nsIComponentRegistrar = Components.interfaces.nsIComponentRegistrar;
-const nsICommandLine        = Components.interfaces.nsICommandLine;
-const nsICommandLineHandler = Components.interfaces.nsICommandLineHandler;
-const nsIFactory            = Components.interfaces.nsIFactory;
-const nsIModule             = Components.interfaces.nsIModule;
-const nsIWindowWatcher      = Components.interfaces.nsIWindowWatcher;
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 
+// This component exists to handle custom command line options
+// First up, some useful constants
 
+// Standalone interface information
 const XUL_STANDALONE = "chrome://open_ils_staff_client/content/circ/offline.xul";
-const XUL_MAIN = "chrome://open_ils_staff_client/content/main/main.xul";
 const WINDOW_STANDALONE = "eg_offline"
+// Main (login) window information
+const XUL_MAIN = "chrome://open_ils_staff_client/content/main/main.xul";
 const WINDOW_MAIN = "eg_main"
 
-const clh_contractID = "@mozilla.org/commandlinehandler/general-startup;1?type=egcli";
-const clh_CID = Components.ID("{7e608198-7355-483a-a85a-20322e4ef91a}");
-// category names are sorted alphabetically. Typical command-line handlers use a
-// category that begins with the letter "m".
-const clh_category = "m-egcli";
-
-/**
- * Utility functions
- */
+// Useful utility functions
 
 /**
  * Opens a chrome window.
@@ -30,221 +19,135 @@ const clh_category = "m-egcli";
  */
 function findOrOpenWindow(aWindowType, aChromeURISpec, aName, aArgument, aLoginInfo)
 {
-  var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"].
-    getService(Components.interfaces.nsIWindowMediator);
-  var targetWindow = wm.getMostRecentWindow(aWindowType);
-  if (targetWindow != null) {
-      var noFocus = false;
-      if(typeof targetWindow.new_tabs == 'function' && aArgument != null) {
-          targetWindow.new_tabs(aArgument);
-          noFocus = true;
-      }
-      if(typeof targetWindow.auto_login == 'function' && aLoginInfo != null) {
-          targetWindow.auto_login(aLoginInfo);
-          noFocus = true;
-      }
-      if(!noFocus) {
-          targetwindow.focus;
-      }
-  }
-  else {
-    var params = null;
-    if (aArgument != null && aArgument.length != 0 || aLoginInfo != null)
-    {
-        params = { "openTabs" : aArgument, "loginInfo" : aLoginInfo };
-        params.wrappedJSObject = params;
-    }
-    var ww = Components.classes["@mozilla.org/embedcomp/window-watcher;1"].
-        getService(Components.interfaces.nsIWindowWatcher);
-    ww.openWindow(null, aChromeURISpec, aName,
-        "chrome,resizable,dialog=no", params);
-  }
-}
- 
-/**
- * The XPCOM component that implements nsICommandLineHandler.
- * It also implements nsIFactory to serve as its own singleton factory.
- */
-const myAppHandler = {
-  /* nsISupports */
-  QueryInterface : function clh_QI(iid)
-  {
-    if (iid.equals(nsICommandLineHandler) ||
-        iid.equals(nsIFactory) ||
-        iid.equals(nsISupports))
-      return this;
-
-    throw Components.results.NS_ERROR_NO_INTERFACE;
-  },
-
-  /* nsICommandLineHandler */
-
-  handle : function clh_handle(cmdLine)
-  {
-    // Each of these options is used for opening a new tab, either on login or remote send.
-    // XULRunner does some sanitize to turn /ilsblah into -ilsblah, for example.
-    // In addition to the ones here, -ilslogin, -ilsoffline, and -ilsstandalone
-    // are defined below.
-
-    // With the exception of 'new', 'tab', and 'init', the value is checked for in urls in main.js.
-
-    // NOTE: The option itself should be all lowercase (we .toLowerCase below)
-    var options = {
-    '-ilscheckin' : 'XUL_CHECKIN',
-    '-ilscheckout' : 'XUL_PATRON_BARCODE_ENTRY',
-    '-ilsnew' : 'new', // 'new' is a special keyword for opening a new window
-    '-ilstab' : 'tab', // 'tab' is a special keyword for opening a new tab with the default content
-    '-ilsnew_default' : 'init', // 'init' is a special keyword for opening a new window with an initial default tab
-    };
-
-    var inParams = new Array();
-    var loginInfo = {};
-    var loginInfoProvided = false;
-	var position = 0;
-	while (position < cmdLine.length) {
-		var arg = cmdLine.getArgument(position).toLowerCase();
-		if (options[arg] != undefined) {
-			inParams.push(options[arg]);
-			cmdLine.removeArguments(position,position);
-			continue;
-		}
-        if (arg == '-ilsurl' && cmdLine.length > position) {
-		  inParams.push(cmdLine.getArgument(position + 1));
-		  cmdLine.removeArguments(position, position + 1);
-		  continue;
-		}
-        if (arg == '-ilshost' && cmdLine.length > position) {
-          loginInfo.host = cmdLine.getArgument(position + 1);
-          cmdLine.removeArguments(position, position + 1);
-          loginInfoProvided = true;
-          continue;
+    var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"]
+             .getService(Components.interfaces.nsIWindowMediator);
+    var targetWindow = wm.getMostRecentWindow(aWindowType);
+    if (targetWindow != null) {
+        var noFocus = false;
+        if(typeof targetWindow.new_tabs == 'function' && aArgument != null) {
+            targetWindow.new_tabs(aArgument);
+            noFocus = true;
         }
-        if (arg == '-ilsuser' && cmdLine.length > position) {
-          loginInfo.user = cmdLine.getArgument(position + 1);
-          cmdLine.removeArguments(position, position + 1);
-          loginInfoProvided = true;
-          continue;
+        if(typeof targetWindow.auto_login == 'function' && aLoginInfo != null) {
+            targetWindow.auto_login(aLoginInfo);
+            noFocus = true;
         }
-        if (arg == '-ilspassword' && cmdLine.length > position) {
-          loginInfo.passwd = cmdLine.getArgument(position + 1);
-          cmdLine.removeArguments(position, position + 1);
-          loginInfoProvided = true;
-          continue;
+        if(!noFocus) {
+            targetWindow.focus();
         }
-		position=position + 1;
-	}
-
-	if (cmdLine.handleFlag("ILSlogin", false) || inParams.length > 0 || loginInfoProvided) {
-	  findOrOpenWindow(WINDOW_MAIN, XUL_MAIN, '_blank', inParams, loginInfoProvided ? loginInfo : null);
-	  cmdLine.preventDefault = true;
-	}
-
-    if (cmdLine.handleFlag("ILSoffline", false) || cmdLine.handleFlag("ILSstandalone", false)) {
-   	  findOrOpenWindow(WINDOW_STANDALONE, XUL_STANDALONE, 'Offline', null, null);
-      cmdLine.preventDefault = true;
-   	}
-  },
-
-  // CHANGEME: change the help info as appropriate, but
-  // follow the guidelines in nsICommandLineHandler.idl
-  // specifically, flag descriptions should start at
-  // character 24, and lines should be wrapped at
-  // 72 characters with embedded newlines,
-  // and finally, the string should end with a newline
-  helpInfo : "  -ILScheckin          Open an Evergreen checkin tab\n" +
-             "  -ILScheckout         Open an Evergreen checkout tab\n" +
-             "  -ILSnew              Open a new Evergreen 'menu' window\n" +
-             "  -ILSnew_default      Open a new Evergreen 'menu' window,\n" +
-             "                       with a 'default' tab\n" +
-             "  -ILStab              Open a 'default' tab alone\n" +
-             "  -ILSurl <url>        Open the specified url in an Evergreen tab\n" +
-             "  -ILShost             Default hostname for login\n" +
-             "  -ILSuser             Default username for login\n" +
-             "  -ILSpassword         Default password for login\n" +
-             "  The above three, if all specified, trigger an automatic login attempt\n" +
-             "  The above nine imply -ILSlogin\n" +
-             "  -ILSlogin            Open the Evergreen Login window\n" +
-             "  -ILSstandalone       Open the Evergreen Standalone interface\n" +
-             "  -ILSoffline          Alias for -ILSstandalone\n",
-
-  /* nsIFactory */
-
-  createInstance : function clh_CI(outer, iid)
-  {
-    if (outer != null)
-      throw Components.results.NS_ERROR_NO_AGGREGATION;
-
-    return this.QueryInterface(iid);
-  },
-
-  lockFactory : function clh_lock(lock)
-  {
-    /* no-op */
-  }
-};
-
-/**
- * The XPCOM glue that implements nsIModule
- */
-const myAppHandlerModule = {
-  /* nsISupports */
-  QueryInterface : function mod_QI(iid)
-  {
-    if (iid.equals(nsIModule) ||
-        iid.equals(nsISupports))
-      return this;
-
-    throw Components.results.NS_ERROR_NO_INTERFACE;
-  },
-
-  /* nsIModule */
-  getClassObject : function mod_gch(compMgr, cid, iid)
-  {
-    if (cid.equals(clh_CID))
-      return myAppHandler.QueryInterface(iid);
-
-    throw Components.results.NS_ERROR_NOT_REGISTERED;
-  },
-
-  registerSelf : function mod_regself(compMgr, fileSpec, location, type)
-  {
-    compMgr.QueryInterface(nsIComponentRegistrar);
-
-    compMgr.registerFactoryLocation(clh_CID,
-                                    "myAppHandler",
-                                    clh_contractID,
-                                    fileSpec,
-                                    location,
-                                    type);
-
-    var catMan = Components.classes["@mozilla.org/categorymanager;1"].
-      getService(nsICategoryManager);
-    catMan.addCategoryEntry("command-line-handler",
-                            clh_category,
-                            clh_contractID, true, true);
-  },
+    }
+    else {
+        var params = null;
+        if (aArgument != null && aArgument.length != 0 || aLoginInfo != null)
+        {
+            params = { "openTabs" : aArgument, "loginInfo" : aLoginInfo };
+            params.wrappedJSObject = params;
+        }
+        var ww = Components.classes["@mozilla.org/embedcomp/window-watcher;1"]
+                 .getService(Components.interfaces.nsIWindowWatcher);
+        ww.openWindow(null, aChromeURISpec, aName, "chrome,resizable,dialog=no", params);
+    }
+}
 
-  unregisterSelf : function mod_unreg(compMgr, location, type)
-  {
-    compMgr.QueryInterface(nsIComponentRegistrar);
-    compMgr.unregisterFactoryLocation(clh_CID, location);
+function oilsCommandLineHandler() {}
+oilsCommandLineHandler.prototype = {
+    classDescription: "OpenILS Command Line Handler",
+    classID:          Components.ID("{7e608198-7355-483a-a85a-20322e4ef91a}"),
+    contractID:       "@mozilla.org/commandlinehandler/general-startup;1?type=egcli",
+    _xpcom_categories: [{
+        category: "command-line-handler",
+        entry: "m-egcli"
+    }],
+    QueryInterface:   XPCOMUtils.generateQI([Components.interfaces.nsICommandLineHandler]),
+    handle : function clh_handle(cmdLine) {
+        // Each of these options is used for opening a new tab, either on login or remote send.
+        // XULRunner does some sanitize to turn /ilsblah into -ilsblah, for example.
+        // In addition to the ones here:
+        // -ilslogin, -ilsoffline, -ilsstandalone, -ilshost, -ilsuser, and -ilspassword
+        // are defined below.
+
+        // With the exception of 'new', 'tab', and 'init', the value is checked for in urls in main.js.
+
+        // NOTE: The option itself should be all lowercase (we .toLowerCase below)
+        var options = {
+            '-ilscheckin' : 'XUL_CHECKIN',
+            '-ilscheckout' : 'XUL_PATRON_BARCODE_ENTRY',
+            '-ilsnew' : 'new', // 'new' is a special keyword for opening a new window
+            '-ilstab' : 'tab', // 'tab' is a special keyword for opening a new tab with the default content
+            '-ilsnew_default' : 'init', // 'init' is a special keyword for opening a new window with an initial default tab
+        };
+
+        var inParams = new Array();
+        var loginInfo = {};
+        var loginInfoProvided = false;
+        var position = 0;
+        while (position < cmdLine.length) {
+            var arg = cmdLine.getArgument(position).toLowerCase();
+            if (options[arg] != undefined) {
+                inParams.push(options[arg]);
+                cmdLine.removeArguments(position,position);
+                continue;
+            }
+            if (arg == '-ilsurl' && cmdLine.length > position) {
+                inParams.push(cmdLine.getArgument(position + 1));
+                cmdLine.removeArguments(position, position + 1);
+                continue;
+            }
+            if (arg == '-ilshost' && cmdLine.length > position) {
+                loginInfo.host = cmdLine.getArgument(position + 1);
+                cmdLine.removeArguments(position, position + 1);
+                loginInfoProvided = true;
+                continue;
+            }
+            if (arg == '-ilsuser' && cmdLine.length > position) {
+                loginInfo.user = cmdLine.getArgument(position + 1);
+                cmdLine.removeArguments(position, position + 1);
+                loginInfoProvided = true;
+                continue;
+            }
+            if (arg == '-ilspassword' && cmdLine.length > position) {
+                loginInfo.passwd = cmdLine.getArgument(position + 1);
+                cmdLine.removeArguments(position, position + 1);
+                loginInfoProvided = true;
+                continue;
+            }
+            position=position + 1;
+        }
 
-    var catMan = Components.classes["@mozilla.org/categorymanager;1"].
-      getService(nsICategoryManager);
-    catMan.deleteCategoryEntry("command-line-handler", clh_category);
-  },
+        if (cmdLine.handleFlag("ILSlogin", false) || inParams.length > 0 || loginInfoProvided) {
+            findOrOpenWindow(WINDOW_MAIN, XUL_MAIN, '_blank', inParams, loginInfoProvided ? loginInfo : null);
+            cmdLine.preventDefault = true;
+        }
 
-  canUnload : function (compMgr)
-  {
-    return true;
-  }
+        if (cmdLine.handleFlag("ILSoffline", false) || cmdLine.handleFlag("ILSstandalone", false)) {
+            findOrOpenWindow(WINDOW_STANDALONE, XUL_STANDALONE, 'Offline', null, null);
+            cmdLine.preventDefault = true;
+        }
+    },
+
+    // Help Info:
+    // Flag descriptions start on char 24
+    // 72 char wrap on lines, embedded newlines
+    // End with a newline
+    helpInfo : "  -ILScheckin          Open an Evergreen checkin tab\n" +
+               "  -ILScheckout         Open an Evergreen checkout tab\n" +
+               "  -ILSnew              Open a new Evergreen 'menu' window\n" +
+               "  -ILSnew_default      Open a new Evergreen 'menu' window,\n" +
+               "                       with a 'default' tab\n" +
+               "  -ILStab              Open a 'default' tab alone\n" +
+               "  -ILSurl <url>        Open the specified url in an Evergreen tab\n" +
+               "  -ILShost             Default hostname for login\n" +
+               "  -ILSuser             Default username for login\n" +
+               "  -ILSpassword         Default password for login\n" +
+               "  The above three, if all specified, trigger an automatic login attempt\n" +
+               "  The above nine imply -ILSlogin\n" +
+               "  -ILSlogin            Open the Evergreen Login window\n" +
+               "  -ILSstandalone       Open the Evergreen Standalone interface\n" +
+               "  -ILSoffline          Alias for -ILSstandalone\n",
 };
 
-/* The NSGetModule function is the magic entry point that XPCOM uses to find what XPCOM objects
- * this component provides
- */
-function NSGetModule(comMgr, fileSpec)
-{
-  return myAppHandlerModule;
-}
+if (XPCOMUtils.generateNSGetFactory)
+    var NSGetFactory = XPCOMUtils.generateNSGetFactory([oilsCommandLineHandler]);
+else
+    var NSGetModule = XPCOMUtils.generateNSGetModule([oilsCommandLineHandler]);
 
diff --git a/Open-ILS/xul/staff_client/components/forceexternal.js b/Open-ILS/xul/staff_client/components/forceexternal.js
index d93aaca..ff0ac5f 100644
--- a/Open-ILS/xul/staff_client/components/forceexternal.js
+++ b/Open-ILS/xul/staff_client/components/forceexternal.js
@@ -1,30 +1,26 @@
-const nsISupports           = Components.interfaces.nsISupports;
-const nsICategoryManager    = Components.interfaces.nsICategoryManager;
-const nsIComponentRegistrar = Components.interfaces.nsIComponentRegistrar;
-const nsIContentPolicy      = Components.interfaces.nsIContentPolicy;
-const nsIFactory            = Components.interfaces.nsIFactory;
-const nsIModule             = Components.interfaces.nsIModule;
-const nsIWindowWatcher      = Components.interfaces.nsIWindowWatcher;
-
-const WINDOW_MAIN = "eg_main"
-
-const fe_contractID = "@mozilla.org/content-policy;1?type=egfe";
-const fe_CID = Components.ID("{D969ED61-DF4C-FA12-A2A6-70AA94C222FB}");
-// category names are sorted alphabetically. Typical command-line handlers use a
-// category that begins with the letter "m".
-const fe_category = "m-egfe";
-
-const myAppHandler = {
-
-   shouldLoad: function(contentType, contentLocation, requestOrigin, node, mimeTypeGuess, extra)
-   {
-      if (contentType == nsIContentPolicy.TYPE_DOCUMENT) {
-          var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"].
-            getService(Components.interfaces.nsIWindowMediator);
-          var targetWindow = wm.getMostRecentWindow("eg_main");
-          if (targetWindow != null) {
-            var host = targetWindow.G.data.server_unadorned;
-            if(host && (contentLocation.scheme == 'http' || contentLocation.scheme == 'https') && contentLocation.host != host) {
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
+// This content policy component tries to prevent outside sites from getting xulG hooks
+// It does so by forcing them to open outside of Evergreen
+
+function oilsForceExternal() {}
+oilsForceExternal.prototype = {
+    classDescription: "OpenILS Force External",
+    classID:          Components.ID("{D969ED61-DF4C-FA12-A2A6-70AA94C222FB}"),
+    contractID:       "@mozilla.org/content-policy;1?type=egfe",
+    _xpcom_categories: [{
+        category: "content-policy",
+        entry: "m-egfe"
+    }],
+    QueryInterface:   XPCOMUtils.generateQI([Components.interfaces.nsIContentPolicy]),
+    shouldLoad: function(contentType, contentLocation, requestOrigin, node, mimeTypeGuess, extra)
+    {
+        if ((contentType == Components.interfaces.nsIContentPolicy.TYPE_DOCUMENT || contentType == Components.interfaces.nsIContentPolicy.TYPE_SUBDOCUMENT)
+          && (contentLocation.scheme == 'http' || contentLocation.scheme == 'https')
+          && node && node.getAttribute('oils_force_external') == 'true') {
+            var data_cache = Components.classes["@open-ils.org/openils_data_cache;1"].getService().wrappedJSObject.data;
+            var host = data_cache.server_unadorned;
+            if(host && contentLocation.host != host) {
                 // first construct an nsIURI object using the ioservice
                 var ioservice = Components.classes["@mozilla.org/network/io-service;1"]
                                 .getService(Components.interfaces.nsIIOService);
@@ -32,112 +28,25 @@ const myAppHandler = {
                 var uriToOpen = ioservice.newURI(contentLocation.spec, null, null);
 
                 var extps = Components.classes["@mozilla.org/uriloader/external-protocol-service;1"]
-                                .getService(Components.interfaces.nsIExternalProtocolService);
+                            .getService(Components.interfaces.nsIExternalProtocolService);
 
                 // now, open it!
                 extps.loadURI(uriToOpen, null);
 
-                return nsIContentPolicy.REJECT_REQUEST;
+                return Components.interfaces.nsIContentPolicy.REJECT_REQUEST;
             }
-          }
-      }
-      return nsIContentPolicy.ACCEPT;
-   },
-
-   shouldProcess: function(contentType, contentLocation, requestOrigin, insecNode, mimeType, extra)
-   {
-      return nsIContentPolicy.ACCEPT;
-   },
-
-  /* nsISupports */
-  QueryInterface : function fe_QI(iid)
-  {
-    if (iid.equals(nsIContentPolicy) ||
-        iid.equals(nsIFactory) ||
-        iid.equals(nsISupports))
-      return this;
-
-    throw Components.results.NS_ERROR_NO_INTERFACE;
-  },
-
-  /* nsIFactory */
-
-  createInstance : function fe_CI(outer, iid)
-  {
-    if (outer != null)
-      throw Components.results.NS_ERROR_NO_AGGREGATION;
-
-    return this.QueryInterface(iid);
-  },
-
-  lockFactory : function fe_lock(lock)
-  {
-    /* no-op */
-  }
-};
-
-/**
- * The XPCOM glue that implements nsIModule
- */
-const myAppHandlerModule = {
-  /* nsISupports */
-  QueryInterface : function mod_QI(iid)
-  {
-    if (iid.equals(nsIModule) ||
-        iid.equals(nsISupports))
-      return this;
-
-    throw Components.results.NS_ERROR_NO_INTERFACE;
-  },
-
-  /* nsIModule */
-  getClassObject : function mod_gch(compMgr, cid, iid)
-  {
-    if (cid.equals(fe_CID))
-      return myAppHandler.QueryInterface(iid);
-
-    throw Components.results.NS_ERROR_NOT_REGISTERED;
-  },
-
-  registerSelf : function mod_regself(compMgr, fileSpec, location, type)
-  {
-    compMgr.QueryInterface(nsIComponentRegistrar);
-
-    compMgr.registerFactoryLocation(fe_CID,
-                                    "myAppHandler",
-                                    fe_contractID,
-                                    fileSpec,
-                                    location,
-                                    type);
-
-    var catMan = Components.classes["@mozilla.org/categorymanager;1"].
-      getService(nsICategoryManager);
-    catMan.addCategoryEntry("content-policy",
-                            fe_category,
-                            fe_contractID, true, true);
-  },
-
-  unregisterSelf : function mod_unreg(compMgr, location, type)
-  {
-    compMgr.QueryInterface(nsIComponentRegistrar);
-    compMgr.unregisterFactoryLocation(fe_CID, location);
-
-    var catMan = Components.classes["@mozilla.org/categorymanager;1"].
-      getService(nsICategoryManager);
-    catMan.deleteCategoryEntry("content-policy", fe_category);
-  },
-
-  canUnload : function (compMgr)
-  {
-    return true;
-  }
+        }
+        return Components.interfaces.nsIContentPolicy.ACCEPT;
+    },
+
+    shouldProcess: function(contentType, contentLocation, requestOrigin, insecNode, mimeType, extra)
+    {
+        return Components.interfaces.nsIContentPolicy.ACCEPT;
+    },
 };
 
-/* The NSGetModule function is the magic entry point that XPCOM uses to find what XPCOM objects
- * this component provides
- */
-function NSGetModule(comMgr, fileSpec)
-{
-  return myAppHandlerModule;
-}
+if (XPCOMUtils.generateNSGetFactory)
+    var NSGetFactory = XPCOMUtils.generateNSGetFactory([oilsForceExternal]);
+else
+    var NSGetModule = XPCOMUtils.generateNSGetModule([oilsForceExternal]);
 
diff --git a/Open-ILS/xul/staff_client/components/inspector-cmdline.js b/Open-ILS/xul/staff_client/components/inspector-cmdline.js
deleted file mode 100644
index badf36a..0000000
--- a/Open-ILS/xul/staff_client/components/inspector-cmdline.js
+++ /dev/null
@@ -1,179 +0,0 @@
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is DOM Inspector.
- *
- * The Initial Developer of the Original Code is
- * Christopher A. Aillon <christopher at aillon.com>.
- * Portions created by the Initial Developer are Copyright (C) 2003
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Christopher A. Aillon <christopher at aillon.com>
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-// NOTE: this file implements both the seamonkey nsICmdLineHandler and
-// the toolkit nsICommandLineHandler, using runtime detection.
-
-const INSPECTOR_CMDLINE_CONTRACTID = "@mozilla.org/commandlinehandler/general-startup;1?type=inspector";
-const INSPECTOR_CMDLINE_CLSID      = Components.ID('{38293526-6b13-4d4f-a075-71939435b408}');
-const CATMAN_CONTRACTID            = "@mozilla.org/categorymanager;1";
-const nsISupports                  = Components.interfaces.nsISupports;
-
-const nsICategoryManager           = Components.interfaces.nsICategoryManager;
-const nsICmdLineHandler            = Components.interfaces.nsICmdLineHandler;
-const nsICommandLine               = Components.interfaces.nsICommandLine;
-const nsICommandLineHandler        = Components.interfaces.nsICommandLineHandler;
-const nsIComponentRegistrar        = Components.interfaces.nsIComponentRegistrar;
-const nsISupportsString            = Components.interfaces.nsISupportsString;
-const nsIWindowWatcher             = Components.interfaces.nsIWindowWatcher;
-
-function InspectorCmdLineHandler() {}
-InspectorCmdLineHandler.prototype =
-{
-  /* nsISupports */
-  QueryInterface : function handler_QI(iid) {
-    if (iid.equals(nsISupports))
-      return this;
-
-    if (nsICmdLineHandler && iid.equals(nsICmdLineHandler))
-      return this;
-
-    if (nsICommandLineHandler && iid.equals(nsICommandLineHandler))
-      return this;
-
-    throw Components.results.NS_ERROR_NO_INTERFACE;
-  },
-
-  /* nsICmdLineHandler */
-  commandLineArgument : "-inspector",
-  prefNameForStartup : "general.startup.inspector",
-  chromeUrlForTask : "chrome://inspector/content/inspector.xul",
-  helpText : "Start with the DOM Inspector.",
-  handlesArgs : true,
-  defaultArgs : "",
-  openWindowWithArgs : true,
-
-  /* nsICommandLineHandler */
-  handle : function handler_handle(cmdLine) {
-    var args = Components.classes["@mozilla.org/supports-string;1"]
-                         .createInstance(nsISupportsString);
-    try {
-      var uristr = cmdLine.handleFlagWithParam("inspector", false);
-      if (uristr == null)
-        return;
-      try {
-        args.data = cmdLine.resolveURI(uristr).spec;
-      }
-      catch (e) {
-        return;
-      }
-    }
-    catch (e) {
-      cmdLine.handleFlag("inspector", true);
-    }
-
-    var wwatch = Components.classes["@mozilla.org/embedcomp/window-watcher;1"]
-                           .getService(nsIWindowWatcher);
-    wwatch.openWindow(null, "chrome://inspector/content/", "_blank",
-                      "chrome,dialog=no,all", args);
-    cmdLine.preventDefault = true;
-  },
-
-  helpInfo : "  -inspector <url>     Open the DOM inspector.\n"
-};
-
-
-var InspectorCmdLineFactory =
-{
-  createInstance : function(outer, iid)
-  {
-    if (outer != null) {
-      throw Components.results.NS_ERROR_NO_AGGREGATION;
-    }
-
-    return new InspectorCmdLineHandler().QueryInterface(iid);
-  }
-};
-
-
-var InspectorCmdLineModule =
-{
-  registerSelf : function(compMgr, fileSpec, location, type)
-  {
-    compMgr = compMgr.QueryInterface(nsIComponentRegistrar);
-
-    compMgr.registerFactoryLocation(INSPECTOR_CMDLINE_CLSID,
-                                    "DOM Inspector CommandLine Service",
-                                    INSPECTOR_CMDLINE_CONTRACTID,
-                                    fileSpec,
-                                    location,
-                                    type);
-
-    var catman = Components.classes[CATMAN_CONTRACTID].getService(nsICategoryManager);
-    catman.addCategoryEntry("command-line-argument-handlers",
-                            "inspector command line handler",
-                            INSPECTOR_CMDLINE_CONTRACTID, true, true);
-    catman.addCategoryEntry("command-line-handler",
-                            "m-inspector",
-                            INSPECTOR_CMDLINE_CONTRACTID, true, true);
-  },
-
-  unregisterSelf : function(compMgr, fileSpec, location)
-  {
-    compMgr = compMgr.QueryInterface(nsIComponentRegistrar);
-
-    compMgr.unregisterFactoryLocation(INSPECTOR_CMDLINE_CLSID, fileSpec);
-    catman = Components.classes[CATMAN_CONTRACTID].getService(nsICategoryManager);
-    catman.deleteCategoryEntry("command-line-argument-handlers",
-                               "inspector command line handler", true);
-    catman.deleteCategoryEntry("command-line-handler",
-                               "m-inspector", true);
-  },
-
-  getClassObject : function(compMgr, cid, iid)
-  {
-    if (cid.equals(INSPECTOR_CMDLINE_CLSID)) {
-      return InspectorCmdLineFactory;
-    }
-
-    if (!iid.equals(Components.interfaces.nsIFactory)) {
-      throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
-    }
-
-    throw Components.results.NS_ERROR_NO_INTERFACE;
-  },
-
-  canUnload : function(compMgr)
-  {
-    return true;
-  }
-};
-
-
-function NSGetModule(compMgr, fileSpec) {
-  return InspectorCmdLineModule;
-}
diff --git a/Open-ILS/xul/staff_client/components/nsIOpenILS.idl b/Open-ILS/xul/staff_client/components/nsIOpenILS.idl
deleted file mode 100644
index 1c1392d..0000000
--- a/Open-ILS/xul/staff_client/components/nsIOpenILS.idl
+++ /dev/null
@@ -1,6 +0,0 @@
-#include "nsISupports.idl"
-[scriptable, uuid(dc3e4b5f-c0f4-4b34-bc57-7b4099c3a5d6)]
-interface nsIOpenILS : nsISupports
-{
-	void help( );
-};
diff --git a/Open-ILS/xul/staff_client/components/nsIOpenILS.xpt b/Open-ILS/xul/staff_client/components/nsIOpenILS.xpt
deleted file mode 100644
index ef2c648..0000000
Binary files a/Open-ILS/xul/staff_client/components/nsIOpenILS.xpt and /dev/null differ
diff --git a/Open-ILS/xul/staff_client/components/nsOpenILS.js b/Open-ILS/xul/staff_client/components/nsOpenILS.js
index e1ae1dd..ca03964 100644
--- a/Open-ILS/xul/staff_client/components/nsOpenILS.js
+++ b/Open-ILS/xul/staff_client/components/nsOpenILS.js
@@ -1,69 +1,49 @@
-function OpenILS(){}
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 
-OpenILS.prototype = {
+// This entire component is a singleton that exists solely to store data.
 
-    help: function () { 
-        dump("Ah ha!  This xpcom isn't really 'xp'.  We make use of the .wrappedJSObject method to get a truly global place to stick data.\n"); 
-    },
-
-    data: {},
-
-    wrappedJSObject: this,
-
-    QueryInterface: function (iid) {
-        if (!iid.equals(Components.interfaces.nsIOpenILS)
-            && !iid.equals(Components.interfaces.nsISupports))
-        {
-            throw Components.results.NS_ERROR_NO_INTERFACE;
-        }
-        return this;
-    }
+function nsOpenILS() {
+    this.wrappedJSObject = this;
 }
 
-var Module = {
-    firstTime: true,
-
-    registerSelf: function (compMgr, fileSpec, location, type) {
-        if (this.firstTime) {
-            dump("*** Deferring registration of OpenILS data cache\n");
-            this.firstTime = false;
-            throw Components.results.NS_ERROR_FACTORY_REGISTER_AGAIN;
+nsOpenILS.prototype = {
+    classDescription: "OpenILS Data Cache",
+    classID:          Components.ID("{dc3e4b5f-c0f4-4b34-bc57-7b4099c3a5d6}"),
+    contractID:       "@open-ils.org/openils_data_cache;1",
+    QueryInterface:   XPCOMUtils.generateQI(),
+    _xpcom_factory:   {
+        singleton: null,
+        createInstance: function (aOuter, aIID) {
+            if (aOuter != null)
+                throw Components.results.NS_ERROR_NO_AGGREGATION;
+            if (this.singleton == null)
+                this.singleton = new nsOpenILS();
+            return this.singleton.QueryInterface(aIID);
+        },
+        getService: function (aIID) {
+            if (aOuter != null)
+                throw Components.results.NS_ERROR_NO_AGGREGATION;
+            if (this.singleton == null)
+                this.singleton = new nsOpenILS();
+            return this.singleton.QueryInterface(aIID);
         }
-        debug("*** Registering OpenILS data cache\n");
-        compMgr = compMgr.QueryInterface(Components.interfaces.nsIComponentRegistrar);
-        compMgr.registerFactoryLocation(this.myCID,
-                                        "OpenILS data cache",
-                                        this.myProgID,
-                                        fileSpec,
-                                        location,
-                                        type);
     },
-
-    getClassObject : function (compMgr, cid, iid) {
-        if (!cid.equals(this.myCID))
-        throw Components.results.NS_ERROR_NO_INTERFACE
-        if (!iid.equals(Components.interfaces.nsIFactory))
-        throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
-        return this.myFactory;
-    },
-
-    myCID: Components.ID("{dc3e4b5f-c0f4-4b34-bc57-7b4099c3a5d6}"),
-    myProgID: "@mozilla.org/openils_data_cache;1",
-
-    myFactory: {
-        createInstance: function (outer, iid) {
-            //dump("CI: " + iid + "\n");
-            if (outer != null)
-            throw Components.results.NS_ERROR_NO_AGGREGATION;
-            return (new OpenILS()).QueryInterface(iid);
+    data: {},
+    openMainEGWindow: function() {
+        var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"]
+                 .getService(Components.interfaces.nsIWindowMediator);
+        var targetWindow = wm.getMostRecentWindow("eg_main");
+        if (targetWindow != null) {
+            targetWindow.focus();
+        } else {
+            var ww = Components.classes["@mozilla.org/embedcomp/window-watcher;1"]
+                     .getService(Components.interfaces.nsIWindowWatcher);
+            ww.openWindow(null, "chrome://open_ils_staff_client/content/main/main.xul", "_blank", "chrome,resizable,dialog=no", null);
         }
     },
+};
 
-    canUnload: function(compMgr) {
-        dump("****** Unloading: OpenILS data cache! ****** \n");
-        return true;
-    }
-}; // END Module
-
-function NSGetModule(compMgr, fileSpec) { return Module; }
-
+if (XPCOMUtils.generateNSGetFactory)
+    var NSGetFactory = XPCOMUtils.generateNSGetFactory([nsOpenILS]);
+else
+    var NSGetModule = XPCOMUtils.generateNSGetModule([nsOpenILS]);
diff --git a/Open-ILS/xul/staff_client/components/oils_protocol.js b/Open-ILS/xul/staff_client/components/oils_protocol.js
new file mode 100644
index 0000000..6210e9b
--- /dev/null
+++ b/Open-ILS/xul/staff_client/components/oils_protocol.js
@@ -0,0 +1,64 @@
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
+// This component is intended to handle remote XUL requests
+
+function oilsProtocol() {}
+
+oilsProtocol.prototype = {
+    _system_principal: null,
+    scheme: "oils",
+    protocolflags: Components.interfaces.nsIProtocolHandler.URI_DANGEROUS_TO_LOAD |
+                   Components.interfaces.nsIProtocolHandler.URI_INHERITS_SECURITY_CONTEXT,
+    newURI: function(aSpec, aOriginCharset, aBaseURI) {
+        var new_url = Components.classes["@mozilla.org/network/standard-url;1"].createInstance(Components.interfaces.nsIStandardURL);
+        new_url.init(1, -1, aSpec, aOriginCharset, aBaseURI);
+        return new_url.QueryInterface(Components.interfaces.nsIURI);
+    },
+    newChannel: function(aURI) {
+        var ios = Components.classes["@mozilla.org/network/io-service;1"].getService(Components.interfaces.nsIIOService);
+        var host;
+        switch(aURI.spec.replace(/^oils:\/\/([^\/]*)\/.*$/,'$1')) {
+            case 'remote':
+                var data_cache = Components.classes["@open-ils.org/openils_data_cache;1"].getService().wrappedJSObject.data;
+                host = data_cache.server_unadorned;
+                break;
+            case 'selfcheck':
+                // To allow elevated permissions on a specific host for selfcheck purposes change this from null.
+                // This is intended for installing an extension on Firefox specifically for selfcheck purposes
+                // NOTE: I honestly don't know how dangerous this might be, but I can't imagine it is worse than the previous "grant the domain permissions to do anything" model.
+                host = null;
+                break;
+            default:
+                return null; // Bad input. Not really sure what to do.
+                break;
+        }
+        if(!host) return null; // Not really sure what to do when we don't have the data we need. Unless manual entry is happening, though, shouldn't be an issue.
+        var chunk = aURI.spec.replace(/^oils:\/\/[^\/]*\//,'');
+        var channel = ios.newChannel("https://" + host + "/" + chunk, null, null).QueryInterface(Components.interfaces.nsIHttpChannel);
+        channel.setRequestHeader("OILS-Wrapper", "true", false);
+        if(this._system_principal == null) {
+            // We don't have the owner?
+            var chrome_service = Components.classesByID['{61ba33c0-3031-11d3-8cd0-0060b0fc14a3}'].getService().QueryInterface(Components.interfaces.nsIProtocolHandler);
+            var chrome_uri = chrome_service.newURI("chrome://open_ils_staff_client/content/main/main.xul", null, null);
+            var chrome_channel = chrome_service.newChannel(chrome_uri);
+            this._system_principal = chrome_channel.owner;
+            var chrome_request = chrome_channel.QueryInterface(Components.interfaces.nsIRequest);
+            chrome_request.cancel(0x804b0002);
+        }
+        if (this._system_principal) channel.owner = this._system_principal;
+        return channel;
+    },
+    allowPort: function(aPort, aScheme) {
+        return false;
+    },
+    classDescription: "OILS Protocol Handler",
+    contractID: "@mozilla.org/network/protocol;1?name=oils",
+    classID: Components.ID('{51d35450-5e59-11e1-b86c-0800200c9a66}'),
+    QueryInterface: XPCOMUtils.generateQI([Components.interfaces.nsIProtocolHandler]),
+}
+
+if (XPCOMUtils.generateNSGetFactory)
+    var NSGetFactory = XPCOMUtils.generateNSGetFactory([oilsProtocol]);
+else
+    var NSGetModule = XPCOMUtils.generateNSGetModule([oilsProtocol]);
+
diff --git a/Open-ILS/xul/staff_client/components/venkman-service.js b/Open-ILS/xul/staff_client/components/venkman-service.js
deleted file mode 100644
index bf75bbc..0000000
--- a/Open-ILS/xul/staff_client/components/venkman-service.js
+++ /dev/null
@@ -1,619 +0,0 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- *
- * ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is The JavaScript Debugger.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Robert Ginda, <rginda at netscape.com>, original author
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/* components defined in this file */
-const CLINE_SERVICE_CTRID =
-    "@mozilla.org/commandlinehandler/general-startup;1?type=venkman";
-const CLINE_SERVICE_CID =
-    Components.ID("{18269616-1dd2-11b2-afa8-b612439bda27}");
-const JSDPROT_HANDLER_CTRID =
-    "@mozilla.org/network/protocol;1?name=x-jsd";
-const JSDPROT_HANDLER_CID =
-    Components.ID("{12ec790d-304e-4525-89a9-3e723d489d14}");
-const JSDCNT_HANDLER_CTRID =
-    "@mozilla.org/uriloader/content-handler;1?type=x-application-jsd";
-const JSDCNT_HANDLER_CID =
-    Components.ID("{306670f0-47bb-466b-b53b-613235623bbd}");
-
-/* components used by this file */
-const CATMAN_CTRID = "@mozilla.org/categorymanager;1";
-const STRING_STREAM_CTRID = "@mozilla.org/io/string-input-stream;1";
-const MEDIATOR_CTRID =
-    "@mozilla.org/appshell/window-mediator;1";
-const ASS_CONTRACTID =
-    "@mozilla.org/appshell/appShellService;1";
-const SIMPLEURI_CTRID = "@mozilla.org/network/simple-uri;1";
-
-const nsIWindowMediator    = Components.interfaces.nsIWindowMediator;
-const nsIAppShellService   = Components.interfaces.nsIAppShellService;
-const nsICmdLineHandler    = Components.interfaces.nsICmdLineHandler;
-const nsIComponentRegistrar = Components.interfaces.nsIComponentRegistrar;
-const nsICategoryManager   = Components.interfaces.nsICategoryManager;
-const nsIContentHandler    = Components.interfaces.nsIContentHandler;
-const nsIProtocolHandler   = Components.interfaces.nsIProtocolHandler;
-const nsIURI               = Components.interfaces.nsIURI;
-const nsIURL               = Components.interfaces.nsIURL;
-const nsIStringInputStream = Components.interfaces.nsIStringInputStream;
-const nsIChannel           = Components.interfaces.nsIChannel;
-const nsIRequest           = Components.interfaces.nsIRequest;
-const nsIProgressEventSink = Components.interfaces.nsIProgressEventSink;
-const nsISupports          = Components.interfaces.nsISupports;
-const nsICommandLineHandler = Components.interfaces.nsICommandLineHandler;
-const nsICommandLine        = Components.interfaces.nsICommandLine;
-
-function findDebuggerWindow ()
-{
-    var windowManager =
-        Components.classes[MEDIATOR_CTRID].getService(nsIWindowMediator);
-    return windowManager.getMostRecentWindow("mozapp:venkman");
-}
-
-function openDebuggerWindow(args)
-{
-    var ass = Components.classes[ASS_CONTRACTID].getService(nsIAppShellService);
-    var window = ass.hiddenDOMWindow;
-    window.openDialog("chrome://venkman/content/venkman.xul", "_blank",
-                      "chrome,menubar,toolbar,status,resizable,dialog=no",
-                      args);
-}
-
-function safeHTML(str)
-{
-    function replaceChars(ch)
-    {
-        switch (ch)
-        {
-            case "<":
-                return "&lt;";
-            
-            case ">":
-                return "&gt;";
-                    
-            case "&":
-                return "&amp;";
-                    
-            case "'":
-                return "&#39;";
-                    
-            case '"':
-                return "&quot;";
-        }
-
-        return "?";
-    };
-        
-    return String(str).replace(/[<>&"']/g, replaceChars);
-}
-
-/* Command Line handler service */
-function CLineService()
-{}
-
-/* nsISupports */
-CLineService.prototype.QueryInterface =
-function handler_QI(iid)
-{
-    if (iid.equals(nsISupports) || 
-        (nsICommandLineHandler && iid.equals(nsICommandLineHandler)) ||
-        (nsICmdLineHandler && iid.equals(nsICmdLineHandler)))
-    {
-        return this;
-    }
-
-    throw Components.results.NS_ERROR_NO_INTERFACE;
-}
-
-/* nsICmdLineHandler */
-CLineService.prototype.commandLineArgument = "-venkman";
-CLineService.prototype.prefNameForStartup = "general.startup.venkman";
-CLineService.prototype.chromeUrlForTask = "chrome://venkman/content";
-CLineService.prototype.helpText = "Start with JavaScript Debugger (Venkman).";
-CLineService.prototype.handlesArgs = false;
-CLineService.prototype.defaultArgs = "";
-CLineService.prototype.openWindowWithArgs = false;
-
-/* nsICommandLineHandler */
-
-CLineService.prototype.handle =
-function handler_handle(cmdLine)
-{
-    try
-    {
-        if (cmdLine.handleFlag("venkman", false))
-            openDebuggerWindow(null);
-    }
-    catch (e)
-    {
-        debug(e);
-    }
-}
-
-CLineService.prototype.helpInfo =
- "  -venkman         Start with JavaScript debugger (Venkman).\n"
-
-/* factory for command line handler service (CLineService) */
-var CLineFactory = new Object();
-
-CLineFactory.createInstance =
-function clf_create (outer, iid) {
-    if (outer != null)
-        throw Components.results.NS_ERROR_NO_AGGREGATION;
-
-    return new CLineService().QueryInterface(iid);
-}
-
-/* x-jsd: protocol handler */
-
-const JSD_DEFAULT_PORT = 2206; /* Dana's apartment number. */
-
-/* protocol handler factory object */
-var JSDProtocolHandlerFactory = new Object();
-
-JSDProtocolHandlerFactory.createInstance =
-function jsdhf_create (outer, iid) {
-    if (outer != null)
-        throw Components.results.NS_ERROR_NO_AGGREGATION;
-
-    if (!iid.equals(nsIProtocolHandler) && !iid.equals(nsISupports))
-        throw Components.results.NS_ERROR_INVALID_ARG;
-
-    return new JSDProtocolHandler();
-}
-
-function JSDURI (spec, charset)
-{
-    this.spec = this.prePath = spec;
-    this.charset = this.originCharset = charset;
-}
-
-JSDURI.prototype.QueryInterface =
-function jsdch_qi (iid)
-{
-    if (!iid.equals(nsIURI) && !iid.equals(nsIURL) &&
-        !iid.equals(nsISupports))
-        throw Components.results.NS_ERROR_NO_INTERFACE;
-
-    return this;
-}
-
-JSDURI.prototype.scheme = "x-jsd";
-
-JSDURI.prototype.fileBaseName =
-JSDURI.prototype.fileExtension =
-JSDURI.prototype.filePath  =
-JSDURI.prototype.param     =
-JSDURI.prototype.query     =
-JSDURI.prototype.ref       =
-JSDURI.prototype.directory =
-JSDURI.prototype.fileName  =
-JSDURI.prototype.username  =
-JSDURI.prototype.password  =
-JSDURI.prototype.hostPort  =
-JSDURI.prototype.path      =
-JSDURI.prototype.asciiHost =
-JSDURI.prototype.userPass  = "";
-
-JSDURI.prototype.port = JSD_DEFAULT_PORT;
-
-JSDURI.prototype.schemeIs =
-function jsduri_schemeis (scheme)
-{
-    return scheme.toLowerCase() == "x-jsd";
-}
-
-JSDURI.prototype.getCommonBaseSpec =
-function jsduri_commonbase (uri)
-{
-    return "x-jsd:";
-}
-
-JSDURI.prototype.getRelativeSpec =
-function jsduri_commonbase (uri)
-{
-    return uri;
-}
-
-JSDURI.prototype.equals =
-function jsduri_equals (uri)
-{
-    return uri.spec == this.spec;
-}
-
-JSDURI.prototype.clone =
-function jsduri_clone ()
-{
-    return new JSDURI (this.spec);
-}
-
-JSDURI.prototype.resolve =
-function jsduri_resolve(path)
-{
-    //dump ("resolve " + path + " from " + this.spec + "\n");
-    if (path[0] == "#")
-        return this.spec + path;
-    
-    return path;
-}
-
-function JSDProtocolHandler()
-{
-    /* nothing here */
-}
-
-JSDProtocolHandler.prototype.scheme = "x-jsd";
-JSDProtocolHandler.prototype.defaultPort = JSD_DEFAULT_PORT;
-JSDProtocolHandler.prototype.protocolFlags = nsIProtocolHandler.URI_NORELATIVE |
-                                             nsIProtocolHandler.URI_NOAUTH;
-if ("URI_DANGEROUS_TO_LOAD" in nsIProtocolHandler) {
-  JSDProtocolHandler.prototype.protocolFlags |=
-      nsIProtocolHandler.URI_DANGEROUS_TO_LOAD;
-}
-
-JSDProtocolHandler.prototype.allowPort =
-function jsdph_allowport (aPort, aScheme)
-{
-    return false;
-}
-
-JSDProtocolHandler.prototype.newURI =
-function jsdph_newuri (spec, charset, baseURI)
-{
-    var clazz = Components.classes[SIMPLEURI_CTRID];
-    var uri = clazz.createInstance(nsIURI);
-    uri.spec = spec;
-    return uri;
-}
-
-JSDProtocolHandler.prototype.newChannel =
-function jsdph_newchannel (uri)
-{
-    return new JSDChannel (uri);
-}
-
-function JSDChannel (uri)
-{
-    this.URI = uri;
-    this.originalURI = uri;
-    this._isPending = false;
-    var clazz = Components.classes[STRING_STREAM_CTRID];
-    this.stringStream = clazz.createInstance(nsIStringInputStream);
-}
-
-JSDChannel.prototype.QueryInterface =
-function jsdch_qi (iid)
-{
-
-    if (!iid.equals(nsIChannel) && !iid.equals(nsIRequest) &&
-        !iid.equals(nsISupports))
-        throw Components.results.NS_ERROR_NO_INTERFACE;
-
-    return this;
-}
-
-/* nsIChannel */
-JSDChannel.prototype.loadAttributes = null;
-JSDChannel.prototype.contentType = "text/html";
-JSDChannel.prototype.contentLength = -1;
-JSDChannel.prototype.owner = null;
-JSDChannel.prototype.loadGroup = null;
-JSDChannel.prototype.notificationCallbacks = null;
-JSDChannel.prototype.securityInfo = null;
-
-JSDChannel.prototype.open =
-function jsdch_open()
-{
-    throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
-}
-
-JSDChannel.prototype.asyncOpen =
-function jsdch_aopen (streamListener, context)
-{
-    this.streamListener = streamListener;
-    this.context = context;
-    this._isPending = true;
-    
-    if (!window && this.URI.spec == "x-jsd:debugger")
-    {
-        this.contentType = "x-application-jsd";
-        this.contentLength = 0;
-        streamListener.onStartRequest(this, context);
-        return;
-    }
-    
-    var window = findDebuggerWindow();
-    var ary = this.URI.spec.match (/x-jsd:([^:]+)/);
-    var exception;
-
-    if (this.loadGroup)
-        this.loadGroup.addRequest (this, null);
-
-    if (window && "console" in window && ary)
-    {
-        try
-        {
-            window.asyncOpenJSDURL (this, streamListener, context);
-            return;
-        }
-        catch (ex)
-        {
-            exception = ex;
-        }
-    }
-
-    var str =
-        "<html><head><title>Error</title></head><body>Could not load &lt;<b>" +
-        safeHTML(this.URI.spec) + "</b>&gt;<br>";
-    
-    if (!ary)
-    {
-        str += "<b>Error parsing uri.</b>";
-    }
-    else if (exception)
-    {
-        str += "<b>Internal error: " + safeHTML(exception) + "</b><br><pre>" + 
-            safeHTML(exception.stack);
-    }
-    else
-    {
-        str += "<b>Debugger is not running.</b>";
-    }
-    
-    str += "</body></html>";
-    
-    this.respond (str);
-}
-
-JSDChannel.prototype.respond =
-function jsdch_respond (str)
-{
-    this.streamListener.onStartRequest (this, this.context);
-
-    var len = str.length;
-    this.stringStream.setData (str, len);
-    this.streamListener.onDataAvailable (this, this.context,
-                                         this.stringStream, 0, len);
-    this.streamListener.onStopRequest (this, this.context,
-                                       Components.results.NS_OK);
-    if (this.loadGroup)
-        this.loadGroup.removeRequest (this, null, Components.results.NS_OK);
-    this._isPending = false;    
-}
-
-/* nsIRequest */
-JSDChannel.prototype.isPending =
-function jsdch_ispending ()
-{
-    return this._isPending;
-}
-
-JSDChannel.prototype.status = Components.results.NS_OK;
-
-JSDChannel.prototype.cancel =
-function jsdch_cancel (status)
-{
-    if (this._isPending)
-    {
-        this._isPending = false;
-        this.streamListener.onStopRequest (this, this.context, status);
-        if (this.loadGroup)
-        {
-            try
-            {
-                this.loadGroup.removeRequest (this, null, status);
-            }
-            catch (ex)
-            {
-                debug ("we're not in the load group?\n");
-            }
-        }
-    }
-    
-    this.status = status;
-}
-
-JSDChannel.prototype.suspend =
-JSDChannel.prototype.resume =
-function jsdch_notimpl ()
-{
-    throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
-}
-
-/*****************************************************************************/
-
-/* x-application-jsd content handler */
-function JSDContentHandler ()
-{}
-
-JSDContentHandler.prototype.QueryInterface =
-function jsdh_qi(iid)
-{
-    if (!iid.equals(nsIContentHandler) && !iid.equals(nsISupports))
-        throw Components.results.NS_ERROR_NO_INTERFACE;
-
-    return this;
-}
-
-JSDContentHandler.prototype.handleContent =
-function jsdh_handle(contentType, windowTarget, request)
-{
-    var e;
-    var channel = request.QueryInterface(nsIChannel);
-    
-    // prevent someone from invoking the debugger remotely by serving
-    // up any old file with the x-application-jsd content type.
-    if (channel.URI.spec != "x-jsd:debugger")
-    {
-        debug ("Not handling content from unknown location ``" +
-               channel.URI.spec + "''");
-        return;
-    }
-    
-    var window = findDebuggerWindow()
-
-    if (window)
-    {
-        window.focus();
-    }
-    else
-    {
-        var ass =
-            Components.classes[ASS_CONTRACTID].getService(nsIAppShellService);
-        window = ass.hiddenDOMWindow;
-
-        var args = new Object();
-        args.url = channel.URI.spec;
-
-        openDebuggerWindow(args);
-     }
-}
-
-/*****************************************************************************/
-
-/* content handler factory object (IRCContentHandler) */
-var JSDContentHandlerFactory = new Object();
-
-JSDContentHandlerFactory.createInstance =
-function jsdhf_create(outer, iid)
-{
-    if (outer != null)
-        throw Components.results.NS_ERROR_NO_AGGREGATION;
-
-    if (!iid.equals(nsIContentHandler) && !iid.equals(nsISupports))
-        throw Components.results.NS_ERROR_INVALID_ARG;
-
-    return new JSDContentHandler();
-}
-
-/*****************************************************************************/
-
-var Module = new Object();
-
-Module.registerSelf =
-function (compMgr, fileSpec, location, type)
-{
-    debug("*** Registering -venkman handler.\n");
-    
-    compMgr = compMgr.QueryInterface(nsIComponentRegistrar);
-
-    compMgr.registerFactoryLocation(CLINE_SERVICE_CID,
-                                    "Venkman CommandLine Service",
-                                    CLINE_SERVICE_CTRID, 
-                                    fileSpec,
-                                    location, 
-                                    type);
-
-    catman = Components.classes[CATMAN_CTRID].getService(nsICategoryManager);
-    catman.addCategoryEntry("command-line-argument-handlers",
-                            "venkman command line handler",
-                            CLINE_SERVICE_CTRID, true, true);
-
-    catman.addCategoryEntry("command-line-handler",
-                            "venkman command line handler",
-                            CLINE_SERVICE_CTRID, true, true);
-
-    debug("*** Registering x-jsd protocol handler.\n");
-    compMgr.registerFactoryLocation(JSDPROT_HANDLER_CID,
-                                    "x-jsd protocol handler",
-                                    JSDPROT_HANDLER_CTRID, 
-                                    fileSpec, 
-                                    location,
-                                    type);
-
-    debug("*** Registering x-application-jsd content handler.\n");
-    compMgr.registerFactoryLocation(JSDCNT_HANDLER_CID,
-                                    "x-application-jsd content handler",
-                                    JSDCNT_HANDLER_CTRID, 
-                                    fileSpec, 
-                                    location,
-                                    type);
-    try
-    {
-        const JSD_CTRID = "@mozilla.org/js/jsd/debugger-service;1";
-        const jsdIDebuggerService = Components.interfaces.jsdIDebuggerService;
-        var jsds = Components.classes[JSD_CTRID].getService(jsdIDebuggerService);
-        jsds.initAtStartup = true;
-    }
-    catch (ex)
-    {
-        debug ("*** ERROR initializing debugger service");
-        debug (ex);
-    }
-}
-
-Module.unregisterSelf =
-function(compMgr, fileSpec, location)
-{
-    compMgr = compMgr.QueryInterface(nsIComponentRegistrar);
-
-    compMgr.unregisterFactoryLocation(CLINE_SERVICE_CID, fileSpec);
-    catman = Components.classes[CATMAN_CTRID].getService(nsICategoryManager);
-    catman.deleteCategoryEntry("command-line-argument-handlers",
-                               CLINE_SERVICE_CTRID, true);
-    catman.deleteCategoryEntry("command-line-handler",
-                               CLINE_SERVICE_CTRID, true);
-}
-
-Module.getClassObject =
-function (compMgr, cid, iid) {
-    if (cid.equals(CLINE_SERVICE_CID))
-        return CLineFactory;
-
-    if (cid.equals(JSDPROT_HANDLER_CID))
-        return JSDProtocolHandlerFactory;
-
-    if (cid.equals(JSDCNT_HANDLER_CID))
-        return JSDContentHandlerFactory;
-    
-    if (!iid.equals(Components.interfaces.nsIFactory))
-        throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
-
-    throw Components.results.NS_ERROR_NO_INTERFACE;
-    
-}
-
-Module.canUnload =
-function(compMgr)
-{
-    return true;
-}
-
-/* entrypoint */
-function NSGetModule(compMgr, fileSpec) {
-    return Module;
-}
diff --git a/Open-ILS/xul/staff_client/external/dojo_template.js b/Open-ILS/xul/staff_client/external/dojo_template.js
index 99eca39..c591620 100644
--- a/Open-ILS/xul/staff_client/external/dojo_template.js
+++ b/Open-ILS/xul/staff_client/external/dojo_template.js
@@ -2,7 +2,6 @@ var error;
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/external/template.js b/Open-ILS/xul/staff_client/external/template.js
index c7b7a36..f3dafc6 100644
--- a/Open-ILS/xul/staff_client/external/template.js
+++ b/Open-ILS/xul/staff_client/external/template.js
@@ -3,7 +3,6 @@ dump('entering example.template.js\n');
 if (typeof example == 'undefined') example = {};
 example.template = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
     } catch(E) {
         dump('example.template: ' + E + '\n');
@@ -15,8 +14,6 @@ example.template.prototype = {
     'init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
             var obj = this;
 
             JSAN.use('util.controller'); obj.controller = new util.controller();
diff --git a/Open-ILS/xul/staff_client/external/template.xul b/Open-ILS/xul/staff_client/external/template.xul
index f666257..55f7693 100644
--- a/Open-ILS/xul/staff_client/external/template.xul
+++ b/Open-ILS/xul/staff_client/external/template.xul
@@ -33,7 +33,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -67,7 +66,7 @@
         <command id="cmd_broken" />
     </commandset>
 
-    <browser id="template_browser" flex="1"/>
+    <browser id="template_browser" flex="1" oils_force_external="true"/>
 
 </window>
 
diff --git a/Open-ILS/xul/staff_client/install.rdf b/Open-ILS/xul/staff_client/install.rdf
index 6d9150e..5491aec 100755
--- a/Open-ILS/xul/staff_client/install.rdf
+++ b/Open-ILS/xul/staff_client/install.rdf
@@ -5,7 +5,7 @@
 
 	<Description about="urn:mozilla:install-manifest">
 		<em:id>staff-client at open-ils.org</em:id>
-		<em:version>1.6</em:version>
+		<em:version>2.2</em:version>
 		<em:type>2</em:type>
 
 		<!-- Target Application this extension can install into, 
@@ -14,7 +14,7 @@
 			<Description>
 				<em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
 				<em:minVersion>3.5</em:minVersion>
-				<em:maxVersion>3.6.*</em:maxVersion>
+				<em:maxVersion>14.*</em:maxVersion>
 			</Description>
 		</em:targetApplication>
     
diff --git a/Open-ILS/xul/staff_client/server/admin/adminlib.js b/Open-ILS/xul/staff_client/server/admin/adminlib.js
index 2a9bd58..58c810c 100644
--- a/Open-ILS/xul/staff_client/server/admin/adminlib.js
+++ b/Open-ILS/xul/staff_client/server/admin/adminlib.js
@@ -15,6 +15,14 @@ function fetchUser(session) {
     if(session == null ) {
         cgi = new CGI();
         session = cgi.param('ses');
+        if(!session && (location.protocol == 'chrome:' || location.protocol == 'oils:')) {
+            try {
+                var CacheClass = Components.classes["@open-ils.org/openils_data_cache;1"].getService();
+                session = CacheClass.wrappedJSObject.data.session.key;
+            } catch(e) {
+                console.log("Error loading XUL stash: " + e);
+            }
+        }
     }
     if(!session) throw "User session is not defined";
     SESSION = session;
diff --git a/Open-ILS/xul/staff_client/server/admin/circ_age_to_lost.js b/Open-ILS/xul/staff_client/server/admin/circ_age_to_lost.js
index 4955ef0..fe1786b 100644
--- a/Open-ILS/xul/staff_client/server/admin/circ_age_to_lost.js
+++ b/Open-ILS/xul/staff_client/server/admin/circ_age_to_lost.js
@@ -3,7 +3,6 @@ var data;
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/admin/copy_locations.js b/Open-ILS/xul/staff_client/server/admin/copy_locations.js
index 542a33d..6ce174f 100644
--- a/Open-ILS/xul/staff_client/server/admin/copy_locations.js
+++ b/Open-ILS/xul/staff_client/server/admin/copy_locations.js
@@ -20,6 +20,14 @@ var myPerms = [
 function clEditorInit() {
     cgi = new CGI();
     session = cgi.param('ses');
+    if(!session && (location.protocol == 'chrome:' || location.protocol == 'oils:')) {
+        try {
+            var CacheClass = Components.classes["@open-ils.org/openils_data_cache;1"].getService();
+            session = CacheClass.wrappedJSObject.data.session.key;
+        } catch(e) {
+            console.log("Error loading XUL stash: " + e);
+        }
+    }
     if(!session) throw "User session is not defined!";
     fetchUser(session);
     $('user').appendChild(text(USER.usrname()));
diff --git a/Open-ILS/xul/staff_client/server/admin/do_not_auto_attempt_print_setting.js b/Open-ILS/xul/staff_client/server/admin/do_not_auto_attempt_print_setting.js
index 461b09f..cd9106a 100644
--- a/Open-ILS/xul/staff_client/server/admin/do_not_auto_attempt_print_setting.js
+++ b/Open-ILS/xul/staff_client/server/admin/do_not_auto_attempt_print_setting.js
@@ -5,7 +5,6 @@ var coust_obj;
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/admin/font_settings.xul b/Open-ILS/xul/staff_client/server/admin/font_settings.xul
index 3b968a5..78f4dd7 100644
--- a/Open-ILS/xul/staff_client/server/admin/font_settings.xul
+++ b/Open-ILS/xul/staff_client/server/admin/font_settings.xul
@@ -33,7 +33,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( document.getElementById("commonStrings").getString('common.jsan.missing') ); }
 
                 JSAN.errorLevel = "die"; // none, warn, or die
@@ -51,7 +50,6 @@
 
         function save() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                 JSAN.use('util.file'); var file = new util.file('global_font_adjust');
                 file.set_object(g.data.global_font_adjust);
                 file.close();
@@ -113,7 +111,6 @@
 
         function save_sound() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                 JSAN.use('util.file'); var file = new util.file('no_sound');
                 file.write_content( 'truncate', String( document.getElementById('sound').checked ) );
                 file.close();
diff --git a/Open-ILS/xul/staff_client/server/admin/hold_pull_list_classic.js b/Open-ILS/xul/staff_client/server/admin/hold_pull_list_classic.js
index 18dc9e7..028b3e6 100644
--- a/Open-ILS/xul/staff_client/server/admin/hold_pull_list_classic.js
+++ b/Open-ILS/xul/staff_client/server/admin/hold_pull_list_classic.js
@@ -12,7 +12,6 @@ var numHolds            = 0;
 var listOffset            = 0;
 
 function pullListInit() {
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
     JSAN.errorLevel = "die"; // none, warn, or die
     JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/admin/index.xhtml b/Open-ILS/xul/staff_client/server/admin/index.xhtml
index 60a3327..1e41098 100644
--- a/Open-ILS/xul/staff_client/server/admin/index.xhtml
+++ b/Open-ILS/xul/staff_client/server/admin/index.xhtml
@@ -76,7 +76,7 @@
                             </div>
                         </td><td>
                             <div style='padding: 8px;'>
-                                <a href='javascript:window.xulG.new_tab(window.xulG.url_prefix("/opac/extras/circ/alt_holds_print.html").replace("http","https") + "?do=shelf_expired_holds&amp;chunk_size=25",{"tab_name":"&staff.server.admin.index.expired_holds_shelf;"},{});'>&staff.server.admin.index.expired_holds_shelf;</a>
+                                <a href='javascript:window.xulG.new_tab(window.xulG.url_prefix("ALT_HOLDS_PRINT").replace("http","https") + "?do=shelf_expired_holds&amp;chunk_size=25",{"tab_name":"&staff.server.admin.index.expired_holds_shelf;"},{});'>&staff.server.admin.index.expired_holds_shelf;</a>
                             </div>
                             <div style='padding: 8px;'>
                                 <a href='javascript:window.xulG.new_tab("/xul/server/patron/holds.xul",{"tab_name":"&staff.server.admin.index.hold_pull_list;"},{});'>&staff.server.admin.index.hold_pull_list;</a> <span style="color: red">&staff.server.admin.index.testing;</span>
diff --git a/Open-ILS/xul/staff_client/server/admin/offline_manage_xacts.js b/Open-ILS/xul/staff_client/server/admin/offline_manage_xacts.js
index a2c4b1a..5531527 100644
--- a/Open-ILS/xul/staff_client/server/admin/offline_manage_xacts.js
+++ b/Open-ILS/xul/staff_client/server/admin/offline_manage_xacts.js
@@ -385,8 +385,8 @@ admin.offline_manage_xacts.prototype = {
 
         for (var i = 0; i < obj.sel_list.length; i++) {
 
-            var url  = xulG.url_prefix(urls.XUL_OFFLINE_MANAGE_XACTS_CGI)
-                + "?ses=" + window.escape(ses())
+            var url  = xulG.url_prefix('XUL_OFFLINE_MANAGE_XACTS_CGI?ses=')
+                + window.escape(ses())
                 + "&action=execute" 
                 + "&seskey=" + window.escape(obj.seslist[obj.sel_list[i]].key)
                 + "&ws=" + window.escape(obj.data.ws_name);
@@ -418,8 +418,8 @@ admin.offline_manage_xacts.prototype = {
         clear_the_cache();
         obj.data.stash_retrieve();
 
-        var url  = xulG.url_prefix(urls.XUL_OFFLINE_MANAGE_XACTS_CGI)
-            + "?ses=" + window.escape(ses())
+        var url  = xulG.url_prefix('XUL_OFFLINE_MANAGE_XACTS_CGI?ses=')
+            + window.escape(ses())
             + "&action=status" 
             + "&seskey=" + window.escape(obj.seslist[ obj.sel_list[0] ].key)
             + "&ws=" + window.escape(obj.data.ws_name)
@@ -443,7 +443,6 @@ admin.offline_manage_xacts.prototype = {
     },
 
     'rename_file' : function() {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var obj = this;
 
         try {
@@ -471,7 +470,6 @@ admin.offline_manage_xacts.prototype = {
     },
 
     'revert_file' : function() {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var obj = this;
 
         try {
@@ -498,7 +496,6 @@ admin.offline_manage_xacts.prototype = {
     },
 
     'archive_file' : function() {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var obj = this;
 
         try {
@@ -513,7 +510,6 @@ admin.offline_manage_xacts.prototype = {
     },
 
     'upload' : function() {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         var obj = this;
 
         try {
@@ -544,7 +540,7 @@ admin.offline_manage_xacts.prototype = {
         var x = document.createElement('iframe'); xx.appendChild(x); x.flex = 1;
         x.setAttribute(
             'src',
-            window.xulG.url_prefix( urls.XUL_REMOTE_BROWSER )
+            window.xulG.url_prefix('XUL_REMOTE_BROWSER')
             /*
             + '?url=' + window.escape(
                 urls.XUL_OFFLINE_UPLOAD_XACTS
@@ -567,7 +563,6 @@ admin.offline_manage_xacts.prototype = {
                 'filename' : obj.transition_filename,
                 'url_prefix' : window.xulG.url_prefix,
                 'handle_event' : function(robj){
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     try {
                         dump('robj = ' + js2JSON(robj) + '\n');
                         if ( robj.ilsevent != 0 ) {
@@ -604,8 +599,8 @@ admin.offline_manage_xacts.prototype = {
         clear_the_cache();
         obj.data.stash_retrieve();
 
-        var url  = xulG.url_prefix(urls.XUL_OFFLINE_MANAGE_XACTS_CGI)
-            + "?ses=" + window.escape(ses())
+        var url  = xulG.url_prefix('XUL_OFFLINE_MANAGE_XACTS_CGI?ses=')
+            + window.escape(ses())
             + "&action=status" 
             + "&seskey=" + window.escape(obj.seslist[obj.sel_list[0]].key)
             + "&ws=" + window.escape(obj.data.ws_name)
@@ -646,8 +641,8 @@ admin.offline_manage_xacts.prototype = {
         clear_the_cache();
         obj.data.stash_retrieve();
 
-        var url  = xulG.url_prefix(urls.XUL_OFFLINE_MANAGE_XACTS_CGI)
-            + "?ses=" + window.escape(ses())
+        var url  = xulG.url_prefix('XUL_OFFLINE_MANAGE_XACTS_CGI?ses=')
+            + window.escape(ses())
             + "&action=create" 
             + "&desc=" + window.escape(desc)
             + "&ws=" + window.escape(obj.data.ws_name);
@@ -681,8 +676,8 @@ admin.offline_manage_xacts.prototype = {
             clear_the_cache();
             obj.data.stash_retrieve();
 
-            var url = xulG.url_prefix(urls.XUL_OFFLINE_MANAGE_XACTS_CGI) 
-                + "?ses=" + window.escape(ses())
+            var url = xulG.url_prefix('XUL_OFFLINE_MANAGE_XACTS_CGI?ses=') 
+                + window.escape(ses())
                 + "&action=status"
                 + "&org=" + window.escape(obj.data.list.au[0].ws_ou())
                 + "&status_type=sessions";
diff --git a/Open-ILS/xul/staff_client/server/admin/offline_manage_xacts.xul b/Open-ILS/xul/staff_client/server/admin/offline_manage_xacts.xul
index 9e2ae92..860327f 100644
--- a/Open-ILS/xul/staff_client/server/admin/offline_manage_xacts.xul
+++ b/Open-ILS/xul/staff_client/server/admin/offline_manage_xacts.xul
@@ -32,7 +32,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( document.getElementById("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/admin/org_unit_settings.js b/Open-ILS/xul/staff_client/server/admin/org_unit_settings.js
index 9ca048c..92bf2ea 100644
--- a/Open-ILS/xul/staff_client/server/admin/org_unit_settings.js
+++ b/Open-ILS/xul/staff_client/server/admin/org_unit_settings.js
@@ -18,6 +18,7 @@ dojo.require('openils.PermaCrud');
 dojo.require('openils.widget.AutoFieldWidget');
 dojo.require('openils.widget.ProgressDialog');
 dojo.require('dijit.Toolbar');
+dojo.require('openils.XUL');
 
 var authtoken;
 var query;
@@ -37,6 +38,10 @@ function osInit(data) {
     showProcessingDialog(true);
     
     authtoken = new openils.CGI().param('ses') || dojo.cookie('ses');
+    if(!authtoken && openils.XUL.isXUL()) {
+        var stash = openils.XUL.getStash();
+        authtoken = stash.session.key;
+    }   
     query = new openils.CGI().param('filter');
     user = new openils.User({authtoken:authtoken});
     contextOrg = user.user.ws_ou();
diff --git a/Open-ILS/xul/staff_client/server/admin/patrons_due_refunds.js b/Open-ILS/xul/staff_client/server/admin/patrons_due_refunds.js
index 3694f65..6bbaaef 100644
--- a/Open-ILS/xul/staff_client/server/admin/patrons_due_refunds.js
+++ b/Open-ILS/xul/staff_client/server/admin/patrons_due_refunds.js
@@ -9,8 +9,6 @@ function refresh() { populate_list(); }
 
 function patrons_due_refunds_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); 
-
         if (typeof JSAN == 'undefined') {
             throw(
                 $('commonStrings').getString('common.jsan.missing')
diff --git a/Open-ILS/xul/staff_client/server/admin/patrons_due_refunds.xul b/Open-ILS/xul/staff_client/server/admin/patrons_due_refunds.xul
index 5faf6b1..26250c7 100644
--- a/Open-ILS/xul/staff_client/server/admin/patrons_due_refunds.xul
+++ b/Open-ILS/xul/staff_client/server/admin/patrons_due_refunds.xul
@@ -59,9 +59,9 @@
     </groupbox>
 
     <popupset id="au_popupset">
-        <popup id="au_actions" position="at_pointer">
+        <menupopup id="au_actions" position="at_pointer">
             <menuitem command="retrieve_patron" />
-        </popup>
+        </menupopup>
     </popupset>
 
 </window>
diff --git a/Open-ILS/xul/staff_client/server/admin/printer_settings.html b/Open-ILS/xul/staff_client/server/admin/printer_settings.html
index fdd0db3..4998ba7 100644
--- a/Open-ILS/xul/staff_client/server/admin/printer_settings.html
+++ b/Open-ILS/xul/staff_client/server/admin/printer_settings.html
@@ -37,7 +37,7 @@
         <input type="radio" name="context" value="offline" onclick="g.set_printer_context('offline');">&staff.printing.context.radio.offline.label;</input>
     </form> 
     <h1>&staff.printing.normal_settings.header;</h1>
-    <iframe id="sample" src="printer_settings.txt"></iframe><br />
+    <iframe id="sample" src="printer_settings.txt" oils_force_external="true"></iframe><br />
     <button onclick="try { g.printer_settings(); } catch(E) { alert(E); }">&staff.printing.set_default;</button>
     <button onclick="try { g.page_settings(); } catch(E) { alert(E); }">&staff.printing.page_settings;</button><br />
     <h1>&staff.printing.advanced_settings.header;</h1>
diff --git a/Open-ILS/xul/staff_client/server/admin/printer_settings.js b/Open-ILS/xul/staff_client/server/admin/printer_settings.js
index 891c9c2..cde2c83 100644
--- a/Open-ILS/xul/staff_client/server/admin/printer_settings.js
+++ b/Open-ILS/xul/staff_client/server/admin/printer_settings.js
@@ -2,7 +2,6 @@ var myPackageDir = 'open_ils_staff_client'; var IAMXUL = true; var g = {};
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
@@ -21,7 +20,6 @@ function my_init() {
         x.checked = print_silent_pref;
 
         /*
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         g.PSSVC = Components.classes["@mozilla.org/gfx/printsettings-service;1"].getService(Components.interfaces.nsIPrintSettingsService);
         g.PO = Components.classes["@mozilla.org/gfx/printsettings-service;1"].getService(Components.interfaces.nsIPrintOptions);
         g.PPSVC = Components.classes["@mozilla.org/embedcomp/printingprompt-service;1"].getService(Components.interfaces.nsIPrintingPromptService);
@@ -35,7 +33,6 @@ function my_init() {
 
 g.toggle_silent_print = function() {
     var x = document.getElementById('print_silent');
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     if (x.checked) {
         g.prefs.setBoolPref('print.always_print_silent', true);
         dump('Setting print.always_print_silent to true\n');
@@ -55,13 +52,11 @@ g.set_printer_context = function(context) {
 }
 
 g.page_settings = function() {
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     g.print.page_settings();
     g.print.save_settings();
 }
 
 g.printer_settings = function() {
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     var print_silent_pref = false;
     if (g.prefs.prefHasUserValue('print.always_print_silent')) {
         print_silent_pref = g.prefs.getBoolPref('print.always_print_silent');
@@ -77,7 +72,6 @@ g.printer_settings = function() {
 }
 
 g.set_print_strategy = function(which) {
-    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
     if (which == 'custom.print') {
         var key = 'oils.printer.external.cmd.' + g.context;
         var has_key = g.prefs.prefHasUserValue(key);
diff --git a/Open-ILS/xul/staff_client/server/admin/stat_cat_editor.js b/Open-ILS/xul/staff_client/server/admin/stat_cat_editor.js
index ae8f327..32bffae 100644
--- a/Open-ILS/xul/staff_client/server/admin/stat_cat_editor.js
+++ b/Open-ILS/xul/staff_client/server/admin/stat_cat_editor.js
@@ -89,6 +89,14 @@ function scSetPerms() {
 function scEditorInit() {
     cgi = new CGI();
     session = cgi.param('ses');
+    if(!session && (location.protocol == 'chrome:' || location.protocol == 'oils:')) {
+        try {
+            var CacheClass = Components.classes["@open-ils.org/openils_data_cache;1"].getService();
+            session = CacheClass.wrappedJSObject.data.session.key;
+        } catch(e) {
+            console.log("Error loading XUL stash: " + e);
+        }
+    }
     if(!session) throw "User session is not defined";
     user = fetchUser(session);
     $('sc_type_selector').onchange = scBuildNew;
diff --git a/Open-ILS/xul/staff_client/server/admin/toolbar.js b/Open-ILS/xul/staff_client/server/admin/toolbar.js
index 8a0e17a..d0dc3cc 100644
--- a/Open-ILS/xul/staff_client/server/admin/toolbar.js
+++ b/Open-ILS/xul/staff_client/server/admin/toolbar.js
@@ -2,7 +2,6 @@ var g = {};
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/admin/transit_list.xul b/Open-ILS/xul/staff_client/server/admin/transit_list.xul
index 5d651f6..b281208 100644
--- a/Open-ILS/xul/staff_client/server/admin/transit_list.xul
+++ b/Open-ILS/xul/staff_client/server/admin/transit_list.xul
@@ -34,7 +34,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( document.getElementById("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -126,7 +125,7 @@
     </vbox>
 
     <popupset id="transit_list_popupset">
-        <popup id="transit_list_actions" position="at_pointer"> 
+        <menupopup id="transit_list_actions" position="at_pointer"> 
             <menuitem command="sel_clip" label="&staff.server.admin.transit.list.copy.label;" accesskey="&staff.server.admin.transit.list.copy.accesskey;" />
             <menuitem command="sel_bucket" label="&staff.server.admin.transit.list.add.label;" accesskey="&staff.server.admin.transit.list.add.accesskey;"/>
             <menuitem command="sel_opac" label="&staff.server.admin.transit.list.show.label;" accesskey="&staff.server.admin.transit.list.show.accesskey;" />
@@ -137,7 +136,7 @@
             <menuitem command="sel_transit_abort" label="&staff.server.admin.transit.list.abort.label;" />
             <menuseparator />
             <menuitem command="save_columns" label="&staff.server.admin.transit.list.save.label;"/>
-        </popup>
+        </menupopup>
     </popupset>
 
     <commandset id="transit_list_cmds">
diff --git a/Open-ILS/xul/staff_client/server/admin/upload_xacts.js b/Open-ILS/xul/staff_client/server/admin/upload_xacts.js
index 35eff03..86bfb9e 100644
--- a/Open-ILS/xul/staff_client/server/admin/upload_xacts.js
+++ b/Open-ILS/xul/staff_client/server/admin/upload_xacts.js
@@ -6,7 +6,6 @@ function $(id) {
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalFileRead");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('..');
@@ -32,7 +31,7 @@ function my_init() {
         $( 'seskey' ).setAttribute('value', xul_param('seskey'));
         $( 'delta' ).setAttribute('value', xul_param('delta'));
 
-        $( 'form' ).setAttribute('action', xulG.url_prefix(urls.XUL_OFFLINE_MANAGE_XACTS_CGI));
+        $( 'form' ).setAttribute('action', xulG.url_prefix('XUL_OFFLINE_MANAGE_XACTS_CGI'));
 
         setTimeout(
             function() {
diff --git a/Open-ILS/xul/staff_client/server/admin/work_log.js b/Open-ILS/xul/staff_client/server/admin/work_log.js
index ffdc2bd..6ff3e67 100644
--- a/Open-ILS/xul/staff_client/server/admin/work_log.js
+++ b/Open-ILS/xul/staff_client/server/admin/work_log.js
@@ -7,7 +7,6 @@ var max_patron_log_entries;
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/admin/work_log.xul b/Open-ILS/xul/staff_client/server/admin/work_log.xul
index 05a01c0..0bcfc67 100644
--- a/Open-ILS/xul/staff_client/server/admin/work_log.xul
+++ b/Open-ILS/xul/staff_client/server/admin/work_log.xul
@@ -57,13 +57,13 @@
     </vbox>
 
     <popupset>
-        <popup id="work_log_actions">
+        <menupopup id="work_log_actions">
             <menuitem label="&staff.admin.work_log.list1.retrieve_item_btn.label;" accesskey="&staff.admin.work_log.list1.retrieve_item_btn.accesskey;" command="cmd_retrieve_item" />
             <menuitem label="&staff.admin.work_log.list1.retrieve_patron_btn.label;" accesskey="&staff.admin.work_log.list1.retrieve_patron_btn.accesskey;" command="cmd_retrieve_patron1" />
-        </popup>
-        <popup id="patron_actions">
+        </menupopup>
+        <menupopup id="patron_actions">
             <menuitem label="&staff.admin.work_log.list2.retrieve_patron_btn.label;" accesskey="&staff.admin.work_log.list2.retrieve_patron_btn.accesskey;" command="cmd_retrieve_patron2" />
-        </popup>
+        </menupopup>
     </popupset>
 
     <commandset>
diff --git a/Open-ILS/xul/staff_client/server/cat/bib_brief.js b/Open-ILS/xul/staff_client/server/cat/bib_brief.js
index 3f36c65..13c57d8 100644
--- a/Open-ILS/xul/staff_client/server/cat/bib_brief.js
+++ b/Open-ILS/xul/staff_client/server/cat/bib_brief.js
@@ -126,7 +126,6 @@ function view_marc() {
         if (docid < 0) {
             alert(document.getElementById("catStrings").getString('staff.cat.bib_brief.noncat.alert'));
         } else {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             //win.open( urls.XUL_MARC_VIEW + '?noprint=1&docid=' + docid, 'marc_view', 'chrome,resizable,modal,width=400,height=400');
             win.open( urls.XUL_MARC_VIEW, 'marc_view', 'chrome,resizable,modal,width=400,height=400',{'noprint':1,'docid':docid});
         }
@@ -189,9 +188,9 @@ function add_volumes() {
         var unified_interface = String( g.data.hash.aous['ui.unified_volume_copy_editor'] ) == 'true';
         if (unified_interface) {
             var horizontal_interface = String( g.data.hash.aous['ui.cat.volume_copy_editor.horizontal'] ) == 'true';
-            url = window.xulG.url_prefix( horizontal_interface ? urls.XUL_VOLUME_COPY_CREATOR_HORIZONTAL : urls.XUL_VOLUME_COPY_CREATOR );
+            url = window.xulG.url_prefix( horizontal_interface ? 'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : 'XUL_VOLUME_COPY_CREATOR' );
         } else {
-            url = window.xulG.url_prefix( urls.XUL_VOLUME_COPY_CREATOR_ORIGINAL );
+            url = window.xulG.url_prefix('XUL_VOLUME_COPY_CREATOR_ORIGINAL');
         }
         var w = xulG.new_tab(
             url,
@@ -204,7 +203,6 @@ function add_volumes() {
 }
 
 function ui_init() {
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     if (typeof JSAN == 'undefined') {
         throw(
             document.getElementById("commonStrings").getString(
@@ -219,7 +217,6 @@ function ui_init() {
 }
 
 function dynamic_grid_replacement(mode) {
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     var prefs = Components.classes[
         '@mozilla.org/preferences-service;1'
     ].getService(
diff --git a/Open-ILS/xul/staff_client/server/cat/bibs_abreast.js b/Open-ILS/xul/staff_client/server/cat/bibs_abreast.js
index 81efb52..eaf58bc 100644
--- a/Open-ILS/xul/staff_client/server/cat/bibs_abreast.js
+++ b/Open-ILS/xul/staff_client/server/cat/bibs_abreast.js
@@ -5,7 +5,6 @@ var lead_record;
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
@@ -192,14 +191,14 @@ function merge_records() {
         if (typeof xulG.on_merge == 'function') {
             xulG.on_merge(robj);
         }
-        var opac_url = xulG.url_prefix( urls.opac_rdetail ) + lead_record;
+        var opac_url = xulG.url_prefix('opac_rdetail') + lead_record;
         var content_params = {
             'session' : ses(),
             'authtime' : ses('authtime'),
             'opac_url' : opac_url,
         };
         xulG.set_tab(
-            xulG.url_prefix(urls.XUL_OPAC_WRAPPER),
+            xulG.url_prefix('XUL_OPAC_WRAPPER'),
             {'tab_name':'Retrieving title...'},
             content_params
         );
diff --git a/Open-ILS/xul/staff_client/server/cat/bibs_abreast.xul b/Open-ILS/xul/staff_client/server/cat/bibs_abreast.xul
index 6d7c652..ad6de27 100644
--- a/Open-ILS/xul/staff_client/server/cat/bibs_abreast.xul
+++ b/Open-ILS/xul/staff_client/server/cat/bibs_abreast.xul
@@ -48,7 +48,7 @@
                 <input name="lead_button" type="radio" xmlns="http://www.w3.org/1999/xhtml"></input>
                 &staff.cat.record_buckets.merge_records.lead;
             </hbox>
-            <iframe name="bib_brief" flex="1" />
+            <iframe name="bib_brief" flex="1" oils_force_external="true" />
             <hbox>
                 <radiogroup flex="0" orient="horizontal">
                     <radio name="view_bib" label="View Bib" />
diff --git a/Open-ILS/xul/staff_client/server/cat/copy_browser.js b/Open-ILS/xul/staff_client/server/cat/copy_browser.js
index 89313fb..b0f0155 100644
--- a/Open-ILS/xul/staff_client/server/cat/copy_browser.js
+++ b/Open-ILS/xul/staff_client/server/cat/copy_browser.js
@@ -4,7 +4,6 @@ dump('entering cat.copy_browser.js\n');
 if (typeof cat == 'undefined') cat = {};
 cat.copy_browser = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
     } catch(E) {
         dump('cat.copy_browser: ' + E + '\n');
@@ -22,7 +21,6 @@ cat.copy_browser.prototype = {
     'init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var obj = this;
 
             obj.docid = params.docid;
@@ -352,9 +350,9 @@ cat.copy_browser.prototype = {
                                     var unified_interface = String( obj.data.hash.aous['ui.unified_volume_copy_editor'] ) == 'true';
                                     if (unified_interface) {
                                         var horizontal_interface = String( obj.data.hash.aous['ui.cat.volume_copy_editor.horizontal'] ) == 'true';
-                                        url = xulG.url_prefix( horizontal_interface ? urls.XUL_VOLUME_COPY_CREATOR_HORIZONTAL : urls.XUL_VOLUME_COPY_CREATOR );
+                                        url = xulG.url_prefix( horizontal_interface ? 'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : 'XUL_VOLUME_COPY_CREATOR' );
                                     } else {
-                                        url = xulG.url_prefix( urls.XUL_VOLUME_COPY_CREATOR_ORIGINAL );
+                                        url = xulG.url_prefix('XUL_VOLUME_COPY_CREATOR_ORIGINAL');
                                     }
 
                                     var w = xulG.new_tab(
@@ -600,7 +598,7 @@ cat.copy_browser.prototype = {
                                     );
 
                                     xulG.new_tab(
-                                        xulG.url_prefix( urls.XUL_SPINE_LABEL ),
+                                        xulG.url_prefix('XUL_SPINE_LABEL'),
                                         { 'tab_name' : document.getElementById('catStrings').getString('staff.cat.copy_browser.print_spine.tab') },
                                         {
                                             'barcodes' : util.functional.map_list( list, function(o){return o.barcode();})
@@ -660,9 +658,9 @@ cat.copy_browser.prototype = {
                                     var unified_interface = String( obj.data.hash.aous['ui.unified_volume_copy_editor'] ) == 'true';
                                     if (unified_interface) {
                                         var horizontal_interface = String( obj.data.hash.aous['ui.cat.volume_copy_editor.horizontal'] ) == 'true';
-                                        url = xulG.url_prefix( horizontal_interface ? urls.XUL_VOLUME_COPY_CREATOR_HORIZONTAL : urls.XUL_VOLUME_COPY_CREATOR );
+                                        url = xulG.url_prefix( horizontal_interface ? 'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : 'XUL_VOLUME_COPY_CREATOR' );
                                     } else {
-                                        url = xulG.url_prefix( urls.XUL_VOLUME_COPY_CREATOR_ORIGINAL );
+                                        url = xulG.url_prefix('XUL_VOLUME_COPY_CREATOR_ORIGINAL');
                                     }
 
                                     var w = xulG.new_tab(
@@ -910,8 +908,6 @@ cat.copy_browser.prototype = {
                                         }
                                     );
 
-                                    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
-
                                     var acn_list = util.functional.map_list(
                                         list,
                                         function (o) {
@@ -929,7 +925,7 @@ cat.copy_browser.prototype = {
                                         + '" accesskey="' 
                                         + document.getElementById('catStrings').getString('staff.cat.copy_browser.transfer.cancel.accesskey') 
                                         + '" name="fancy_cancel"/></hbox>';
-                                    xml += '<iframe style="overflow: scroll" flex="1" src="' + urls.XUL_BIB_BRIEF + '?docid=' + obj.data.marked_library.docid + '"/>';
+                                    xml += '<iframe style="overflow: scroll" flex="1" src="' + urls.XUL_BIB_BRIEF + '?docid=' + obj.data.marked_library.docid + '" oils_force_external="true"/>';
                                     xml += '</vbox>';
                                     JSAN.use('OpenILS.data');
                                     var data = new OpenILS.data(); data.init({'via':'stash'});
@@ -1050,7 +1046,7 @@ cat.copy_browser.prototype = {
                                     );
 
                                     xulG.new_tab(
-                                        window.xulG.url_prefix(urls.MANAGE_MULTI_HOME_ITEMS),
+                                        window.xulG.url_prefix('MANAGE_MULTI_HOME_ITEMS'),
                                         {},
                                         { 'docid' : obj.data.marked_multi_home_record, 'barcodes' : list }
                                     );
@@ -1501,7 +1497,6 @@ cat.copy_browser.prototype = {
 
     'append_org' : function (org,parent_org,params) {
         var obj = this;
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         obj.error.consoleService.logStringMessage('append_org: org = ' + org.shortname() + ' parent_org = ' + (parent_org ? parent_org.shortname() : '') + ' params = ' + js2JSON(params) + '\n');
         try {
             if (obj.map_tree[ 'aou_' + org.id() ]) {
@@ -1714,7 +1709,6 @@ cat.copy_browser.prototype = {
     'list_init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var obj = this;
             
             JSAN.use('circ.util');
@@ -1834,7 +1828,6 @@ cat.copy_browser.prototype = {
                         return row;
                     },
                     'on_click' : function(ev) {
-                        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserRead');
                         var row = {}; var col = {}; var nobj = {};
                         obj.list.node.treeBoxObject.getCellAt(ev.clientX,ev.clientY,row,col,nobj); 
                         if ((row.value == -1)||(nobj.value != 'twisty')) { return; }
diff --git a/Open-ILS/xul/staff_client/server/cat/copy_browser.xul b/Open-ILS/xul/staff_client/server/cat/copy_browser.xul
index ba64563..51ee003 100644
--- a/Open-ILS/xul/staff_client/server/cat/copy_browser.xul
+++ b/Open-ILS/xul/staff_client/server/cat/copy_browser.xul
@@ -39,7 +39,6 @@ vim:noet:sw=4:ts=4:
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { 
                     throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                 }
@@ -104,7 +103,7 @@ vim:noet:sw=4:ts=4:
     </commandset>
 
     <popupset>
-        <popup id="copy_browser_actions">
+        <menupopup id="copy_browser_actions">
             <menuitem command="sel_clip" label="&staff.cat.copy_browser.actions.sel_clip.label;" accesskey="&staff.cat.copy_browser.actions.sel_clip.accesskey;"/>
             <menuitem command="cmd_add_items_to_buckets" label="&staff.cat.copy_browser.actions.cmd_add_items_to_buckets.label;" accesskey="&staff.cat.copy_browser.actions.cmd_add_items_to_buckets.accesskey;"/>
             <menuitem command="sel_copy_details" label="&staff.cat.copy_browser.actions.sel_copy_details.label;" accesskey="&staff.cat.copy_browser.actions.sel_copy_details.label;" />
@@ -137,7 +136,7 @@ vim:noet:sw=4:ts=4:
             <menuitem command="cmd_replace_barcode" label="&staff.cat.copy_browser.holdings_maintenance.cmd_replace_barcode.label;" accesskey="&staff.cat.copy_browser.holdings_maintenance.cmd_replace_barcode.accesskey;"/>
             <menuitem command="save_columns" label="&staff.cat.copy_browser.actions.save_columns.label;"/>
             <menuitem command="cmd_refresh_list" label="&staff.cat.copy_browser.actions.cmd_refresh_list.label;" accesskey="&staff.cat.copy_browser.actions.cmd_refresh_list.accesskey;"/>
-        </popup>
+        </menupopup>
     </popupset>
 
     <groupbox flex="1" class="my_overflow">
diff --git a/Open-ILS/xul/staff_client/server/cat/copy_buckets.xul b/Open-ILS/xul/staff_client/server/cat/copy_buckets.xul
index 90f2d19..1c4d25e 100644
--- a/Open-ILS/xul/staff_client/server/cat/copy_buckets.xul
+++ b/Open-ILS/xul/staff_client/server/cat/copy_buckets.xul
@@ -33,7 +33,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( document.getElementById("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/cat/copy_buckets_quick.xul b/Open-ILS/xul/staff_client/server/cat/copy_buckets_quick.xul
index 36636fd..4d5894f 100644
--- a/Open-ILS/xul/staff_client/server/cat/copy_buckets_quick.xul
+++ b/Open-ILS/xul/staff_client/server/cat/copy_buckets_quick.xul
@@ -38,7 +38,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') {
                     throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                 }
diff --git a/Open-ILS/xul/staff_client/server/cat/copy_editor.js b/Open-ILS/xul/staff_client/server/cat/copy_editor.js
index f4af660..48aeb39 100644
--- a/Open-ILS/xul/staff_client/server/cat/copy_editor.js
+++ b/Open-ILS/xul/staff_client/server/cat/copy_editor.js
@@ -9,7 +9,6 @@ function my_init() {
         /******************************************************************************************************/
         /* setup JSAN and some initial libraries */
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') {
             throw( $('commonStrings').getString('common.jsan.missing') );
         }
@@ -431,7 +430,6 @@ g.delete_template = function() {
 
 g.export_templates = function() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.file'); var f = new util.file('');
         f.export_file( { 'title' : $('catStrings').getString('staff.cat.copy_editor.export_templates.title'), 'data' : g.templates } );
     } catch(E) {
@@ -444,7 +442,6 @@ g.export_templates = function() {
 
 g.import_templates = function() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.file'); var f = new util.file('');
         var temp = f.import_file( { 'title' : $('catStrings').getString('staff.cat.copy_editor.import_templates.title') } );
         if (temp) {
diff --git a/Open-ILS/xul/staff_client/server/cat/copy_notes.xul b/Open-ILS/xul/staff_client/server/cat/copy_notes.xul
index 1da6032..fb633a7 100644
--- a/Open-ILS/xul/staff_client/server/cat/copy_notes.xul
+++ b/Open-ILS/xul/staff_client/server/cat/copy_notes.xul
@@ -40,7 +40,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { 
                     throw( $("commonStrings").getString('common.jsan.missing') );
                 }
@@ -155,7 +154,6 @@
         
         function new_note() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalBrowserWrite");
                 var xml = '<groupbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1"> \
                     <caption label="' + $('catStrings').getString('staff.cat.copy_notes.new_note.label') + '"/> \
                     <grid flex="1"><columns><column/><column flex="1"/></columns> \
diff --git a/Open-ILS/xul/staff_client/server/cat/copy_summary.xul b/Open-ILS/xul/staff_client/server/cat/copy_summary.xul
index 9ab9a04..3bc5723 100644
--- a/Open-ILS/xul/staff_client/server/cat/copy_summary.xul
+++ b/Open-ILS/xul/staff_client/server/cat/copy_summary.xul
@@ -40,7 +40,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { 
                     throw( $("commonStrings").getString('common.jsan.missing') );
                 }
diff --git a/Open-ILS/xul/staff_client/server/cat/manage_multi_home_items.js b/Open-ILS/xul/staff_client/server/cat/manage_multi_home_items.js
index 04df58d..ff7836d 100644
--- a/Open-ILS/xul/staff_client/server/cat/manage_multi_home_items.js
+++ b/Open-ILS/xul/staff_client/server/cat/manage_multi_home_items.js
@@ -11,8 +11,6 @@ function default_focus() { document.getElementById('scanbox').focus(); }
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); 
-
         commonStrings = $('commonStrings');
         catStrings = $('catStrings');
 
diff --git a/Open-ILS/xul/staff_client/server/cat/manage_multi_home_items.xul b/Open-ILS/xul/staff_client/server/cat/manage_multi_home_items.xul
index cb905a7..fa73926 100644
--- a/Open-ILS/xul/staff_client/server/cat/manage_multi_home_items.xul
+++ b/Open-ILS/xul/staff_client/server/cat/manage_multi_home_items.xul
@@ -48,11 +48,11 @@
     </commandset>
 
     <popupset>
-        <popup id="actions">
+        <menupopup id="actions">
             <menuitem command="opac" />
             <menuitem command="change" />
             <menuitem command="remove" />
-        </popup>
+        </menupopup>
     </popupset>
 
     <groupbox id="bib_brief_groupbox" hidden="true">
diff --git a/Open-ILS/xul/staff_client/server/cat/marc_new.xul b/Open-ILS/xul/staff_client/server/cat/marc_new.xul
index 7a9209d..ae5d3d2 100644
--- a/Open-ILS/xul/staff_client/server/cat/marc_new.xul
+++ b/Open-ILS/xul/staff_client/server/cat/marc_new.xul
@@ -40,8 +40,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
                 /* load translatable strings for cataloging interfaces */
                 catStrings = document.getElementById('catStrings');
 
@@ -123,7 +121,7 @@
 
                                             /* Replace tab with OPAC-view of record */
 
-                                            var opac_url = xulG.url_prefix( urls.opac_rdetail ) + robj.id();
+                                            var opac_url = xulG.url_prefix('opac_rdetail') + robj.id();
                                             var content_params = {
                                                 'session' : ses(),
                                                 'authtime' : ses('authtime'),
@@ -134,7 +132,7 @@
                                                 'on_complete' : function() {
                                                     try {
                                                         xulG.set_tab(
-                                                            xulG.url_prefix(urls.XUL_OPAC_WRAPPER),
+                                                            xulG.url_prefix('XUL_OPAC_WRAPPER'),
                                                             {'tab_name': catStrings.getString('staff.cat.marc_new.retrieving.label')},
                                                             content_params
                                                         );
@@ -158,7 +156,6 @@
                             $('marc_editor_box').appendChild(marc_editor);
                             marc_editor.setAttribute('flex','1');
                             marc_editor.setAttribute('src',url);
-                            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                             get_contentWindow(marc_editor).xulG = params;
 
                             /* hide template widgets */
@@ -181,7 +178,6 @@
                     function(ev) {
                         var template_name;
                         try {
-                            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                             template_name = $('menu_placeholder').firstChild.value;
                             g.prefs.setCharPref(default_template_key, template_name);
                             alert(catStrings.getFormattedString('staff.cat.marc_new.set_default.success', [template_name]));
diff --git a/Open-ILS/xul/staff_client/server/cat/marc_view.html b/Open-ILS/xul/staff_client/server/cat/marc_view.html
index ba1bae3..292add7 100644
--- a/Open-ILS/xul/staff_client/server/cat/marc_view.html
+++ b/Open-ILS/xul/staff_client/server/cat/marc_view.html
@@ -11,7 +11,6 @@
 
     function xsl_marc2html_init() {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             xsltProcessor = new XSLTProcessor();
             var req = new XMLHttpRequest();
             req.open("GET", urls.xsl_marc2html, false);
@@ -31,7 +30,6 @@
 
     function apply_xsl_marc2html(marc) {
         try {
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             var obj = this;
             var parser = new DOMParser();
             var doc = parser.parseFromString( marc, 'text/xml' );
diff --git a/Open-ILS/xul/staff_client/server/cat/marc_view.xul b/Open-ILS/xul/staff_client/server/cat/marc_view.xul
index 0f6f8a2..7ad8343 100644
--- a/Open-ILS/xul/staff_client/server/cat/marc_view.xul
+++ b/Open-ILS/xul/staff_client/server/cat/marc_view.xul
@@ -36,7 +36,6 @@ vim:noet:sw=4:ts=4:
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { 
                     throw( document.getElementById('commonStrings').getString('common.jsan.missing') );
                 }
@@ -68,7 +67,7 @@ vim:noet:sw=4:ts=4:
                         function(req) {
                             var marc_html = req.getResultObject();
                             if (noprint||typeof xulG == 'undefined') marc_html = marc_html.replace(/<button.+?button>/, '');
-                            document.getElementById('marc_frame').setAttribute('src', 'data:text/html,' + marc_html);
+                            document.getElementById('marc_frame').setAttribute('src', 'data:text/html,' + encodeURIComponent(marc_html));
                         }
                     );
                 } else {
@@ -90,7 +89,7 @@ vim:noet:sw=4:ts=4:
 
     <groupbox flex="1">
         <caption label="&staff.cat.marc_view.title;"/>
-        <iframe id="marc_frame" flex="1"/>
+        <iframe id="marc_frame" flex="1" oils_force_external="true"/>
     </groupbox>
 
 </window>
diff --git a/Open-ILS/xul/staff_client/server/cat/marcedit.js b/Open-ILS/xul/staff_client/server/cat/marcedit.js
index 418d0ee..5c73636 100644
--- a/Open-ILS/xul/staff_client/server/cat/marcedit.js
+++ b/Open-ILS/xul/staff_client/server/cat/marcedit.js
@@ -152,7 +152,6 @@ function set_flat_editor (useFlatText) {
 function my_init() {
     try {
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
@@ -225,7 +224,6 @@ function my_init() {
         var locale = "en-US";
 
         // Try to get the locale from our preferences
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         try {
             const Cc = Components.classes;
             const Ci = Components.interfaces;
@@ -495,7 +493,7 @@ function setFocusToNextTag (row, direction) {
 function createMARCTextbox (element,attrs) {
 
     var box = createComplexXULElement('textbox', attrs, Array.prototype.slice.apply(arguments, [2]) );
-    box.addEventListener('keypress',function(ev) { netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); if (!(ev.altKey || ev.ctrlKey || ev.metaKey)) { oils_lock_page(); } },false);
+    box.addEventListener('keypress',function(ev) { if (!(ev.altKey || ev.ctrlKey || ev.metaKey)) { oils_lock_page(); } },false);
     box.onkeypress = function (event) {
         var root_node;
         var node = element;
@@ -2050,7 +2048,6 @@ function loadMarcEditor(pcrud, marcxml, target, sf) {
        To run in Firefox directly, must set signed.applets.codebase_principal_support
        to true in about:config
      */
-    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
     win = window.open('/xul/server/cat/marcedit.xul'); // XXX version?
 
     // Match marc2are.pl last_xact_id format, roughly
diff --git a/Open-ILS/xul/staff_client/server/cat/marcedit.xul b/Open-ILS/xul/staff_client/server/cat/marcedit.xul
index 195edae..0519d06 100644
--- a/Open-ILS/xul/staff_client/server/cat/marcedit.xul
+++ b/Open-ILS/xul/staff_client/server/cat/marcedit.xul
@@ -46,9 +46,9 @@
     </hbox>
     <hbox id="fastItemAdd_textboxes">
         <label control="fastItemAdd_callnumber" accesskey="&staff.cat.marcedit.fastItemAdd_callnumber.accesskey;" value="&staff.cat.marcedit.fastItemAdd_callnumber.label;" />
-        <textbox onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" context="clipboard" id="fastItemAdd_callnumber" />
+        <textbox onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" context="clipboard" id="fastItemAdd_callnumber" />
         <label control="fastItemAdd_barcode" accesskey="&staff.cat.marcedit.fastItemAdd_barcode.accesskey;" value="&staff.cat.marcedit.fastItemAdd_barcode.label;" />
-        <textbox onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" context="clipboard" id="fastItemAdd_barcode"/>
+        <textbox onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" context="clipboard" id="fastItemAdd_barcode"/>
     </hbox>
 </groupbox>
 
@@ -80,157 +80,157 @@
                     <rows>
                         <row>
                             <label name="Type" control="Type_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="Type" />
-                            <textbox id="Type_tb" context="clipboard" class="plain" name="Type" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Type_tb" context="clipboard" class="plain" name="Type" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="ELvl" control="ELvl_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="ELvl" />
-                            <textbox id="Elvl_tb" context="clipboard" class="plain" name="ELvl" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Elvl_tb" context="clipboard" class="plain" name="ELvl" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Srce" control="Srce_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="Srce" />
-                            <textbox id="Srce_tb" context="clipboard" class="plain" name="Srce" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Srce_tb" context="clipboard" class="plain" name="Srce" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Audn" control="Audn_tb" set="BKS VIS SCO REC COM" value="Audn" />
-                            <textbox id="Audn_tb" context="clipboard" class="plain" name="Audn" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Audn_tb" context="clipboard" class="plain" name="Audn" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Ctrl" control="Ctrl_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="Ctrl" />
-                            <textbox id="Ctrl_tb" context="clipboard" class="plain" name="Ctrl" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Ctrl_tb" context="clipboard" class="plain" name="Ctrl" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Lang" control="Lang_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="Lang" />
-                            <textbox id="Lang_tb" context="clipboard" class="plain" name="Lang" maxlength="3" size="3" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Lang_tb" context="clipboard" class="plain" name="Lang" maxlength="3" size="3" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="BLvl" control="BLvl_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="BLvl" />
-                            <textbox id="BLvl_tb" context="clipboard" class="plain" name="BLvl" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="BLvl_tb" context="clipboard" class="plain" name="BLvl" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Form" control="Form_tb" set="BKS SER VIS MIX MAP SCO REC" value="Form" />
-                            <textbox id="Form_tb" context="clipboard" class="plain" name="Form" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Form_tb" context="clipboard" class="plain" name="Form" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Conf" control="Conf_tb" set="BKS SER" value="Conf" />
-                            <textbox id="Conf_tb" context="clipboard" class="plain" name="Conf" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Conf_tb" context="clipboard" class="plain" name="Conf" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Biog" control="Biog_tb" set="BKS" value="Biog" />
-                            <textbox id="Biog_tb" context="clipboard" class="plain" name="Biog" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Biog_tb" context="clipboard" class="plain" name="Biog" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="MRec" control="MRec_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="MRec" />
-                            <textbox id="MRec_tb" context="clipboard" class="plain" name="MRec" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="MRec_tb" context="clipboard" class="plain" name="MRec" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Ctry" control="Ctry_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="Ctry" />
-                            <textbox id="Ctry_tb" context="clipboard" class="plain" name="Ctry" maxlength="3" size="3" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Ctry_tb" context="clipboard" class="plain" name="Ctry" maxlength="3" size="3" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="S/L" control="s_l_tb" set="SER" value="S/L" />
-                            <textbox id="s_l_tb" context="clipboard" class="plain" name="S/L" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="s_l_tb" context="clipboard" class="plain" name="S/L" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Cont" control="Cont_tb" set="BKS SER" value="Cont" />
-                            <textbox id="Cont_tb" context="clipboard" class="plain" name="Cont" maxlength="4" size="4" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Cont_tb" context="clipboard" class="plain" name="Cont" maxlength="4" size="4" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="GPub" control="GPub_tb" set="BKS SER VIS MAP COM" value="GPub" />
-                            <textbox id="GPub_tb" context="clipboard" class="plain" name="GPub" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="GPub_tb" context="clipboard" class="plain" name="GPub" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="LitF" control="LitF_tb" set="BKS" value="LitF" />
-                            <textbox id="LitF_tb" context="clipboard" class="plain" name="LitF" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="LitF_tb" context="clipboard" class="plain" name="LitF" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Indx" control="Indx_tb" set="BKS MAP" value="Indx" />
-                            <textbox id="Indx_tb" context="clipboard" class="plain" name="Indx" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Indx_tb" context="clipboard" class="plain" name="Indx" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Alph" control="Alph_tb" set="SER" value="Alph" />
-                            <textbox id="Alph_tb" context="clipboard" class="plain" name="Alph" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Alph_tb" context="clipboard" class="plain" name="Alph" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="Desc" control="Desc_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="Desc" />
-                            <textbox id="Desc_tb" context="clipboard" class="plain" name="Desc" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Desc_tb" context="clipboard" class="plain" name="Desc" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Ills" control="Ills_tb" set="BKS" value="Ills" />
-                            <textbox id="Ills_tb" context="clipboard" class="plain" name="Ills" maxlength="4" size="4" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Ills_tb" context="clipboard" class="plain" name="Ills" maxlength="4" size="4" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Fest" control="Fest_tb" set="BKS" value="Fest" />
-                            <textbox id="Fest_tb" context="clipboard" class="plain" name="Fest" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Fest_tb" context="clipboard" class="plain" name="Fest" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="DtSt" control="DtSt_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="DtSt" />
-                            <textbox id="DtSt_tb" context="clipboard" class="plain" name="DtSt" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="DtSt_tb" context="clipboard" class="plain" name="DtSt" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Date1" control="Date1_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="Date1" />
-                            <textbox id="Date1_tb" context="clipboard" class="plain" name="Date1" maxlength="4" size="4" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Date1_tb" context="clipboard" class="plain" name="Date1" maxlength="4" size="4" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Date2" control="Date2_tb" set="BKS SER VIS MIX MAP SCO REC COM" value="Date2" />
-                            <textbox id="Date2_tb" context="clipboard" class="plain" name="Date2" maxlength="4" size="4" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Date2_tb" context="clipboard" class="plain" name="Date2" maxlength="4" size="4" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="SrTp" control="SrTp_tb" set="SER" value="SrTp" />
-                            <textbox id="SrTp_tb" context="clipboard" class="plain" name="SrTp" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="SrTp_tb" context="clipboard" class="plain" name="SrTp" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Regl" control="Regl_tb" set="SER" value="Regl" />
-                            <textbox id="Regl_tb" context="clipboard" class="plain" name="Regl" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Regl_tb" context="clipboard" class="plain" name="Regl" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Orig" control="Orig_tb" set="SER" value="Orig" />
-                            <textbox id="Orig_tb" context="clipboard" class="plain" name="Orig" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Orig_tb" context="clipboard" class="plain" name="Orig" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Freq" control="Freq_tb" set="SER" value="Freq" />
-                            <textbox id="Freq_tb" context="clipboard" class="plain" name="Freq" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Freq_tb" context="clipboard" class="plain" name="Freq" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="EntW" control="EntW_tb" set="SER" value="EntW" />
-                            <textbox id="EntW_tb" context="clipboard" class="plain" name="EntW" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="EntW_tb" context="clipboard" class="plain" name="EntW" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="TrAr" control="TrAr_tb" set="SCO REC" value="TrAr" />
-                            <textbox id="TrAr_tb" context="clipboard" class="plain" name="TrAr" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="TrAr_tb" context="clipboard" class="plain" name="TrAr" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Part" control="Part_tb" set="SCO REC" value="Part" />
-                            <textbox id="Part_tb" context="clipboard" class="plain" name="Part" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Part_tb" context="clipboard" class="plain" name="Part" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="LTxt" control="LTxt_tb" set="SCO REC" value="LTxt" />
-                            <textbox id="LTxt_tb" context="clipboard" class="plain" name="LTxt" maxlength="2" size="2" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="LTxt_tb" context="clipboard" class="plain" name="LTxt" maxlength="2" size="2" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="FMus" control="FMus_tb" set="SCO REC" value="FMus" />
-                            <textbox id="FMus_tb" context="clipboard" class="plain" name="FMus" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="FMus_tb" context="clipboard" class="plain" name="FMus" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="AccM" control="AccM_tb" set="SCO REC" value="AccM" />
-                            <textbox id="AccM_tb" context="clipboard" class="plain" name="AccM" maxlength="6" size="6" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="AccM_tb" context="clipboard" class="plain" name="AccM" maxlength="6" size="6" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Comp" control="Comp_tb" set="SCO REC" value="Comp" />
-                            <textbox id="Comp_tb" context="clipboard" class="plain" name="Comp" maxlength="2" size="2" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Comp_tb" context="clipboard" class="plain" name="Comp" maxlength="2" size="2" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="SpFm" control="SpFm_tb" set="MAP" value="SpFm" />
-                            <textbox id="SpFm_tb" context="clipboard" class="plain" name="SpFm" maxlength="2" size="2" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="SpFm_tb" context="clipboard" class="plain" name="SpFm" maxlength="2" size="2" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Relf" control="Relf_tb" set="MAP" value="Relf" />
-                            <textbox id="Relf_tb" context="clipboard" class="plain" name="Relf" maxlength="4" size="4" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Relf_tb" context="clipboard" class="plain" name="Relf" maxlength="4" size="4" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Proj" control="Proj_tb" set="MAP" value="Proj" />
-                            <textbox id="Proj_tb" context="clipboard" class="plain" name="Proj" maxlength="2" size="2" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Proj_tb" context="clipboard" class="plain" name="Proj" maxlength="2" size="2" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="CrTp" control="CrTp_tb" set="MAP" value="CrTp" />
-                            <textbox id="CrTp_tb" context="clipboard" class="plain" name="CrTp" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="CrTp_tb" context="clipboard" class="plain" name="CrTp" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="TMat" control="TMat_tb" set="VIS" value="TMat" />
-                            <textbox id="TMat_tb" context="clipboard" class="plain" name="TMat" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="TMat_tb" context="clipboard" class="plain" name="TMat" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Time" control="Time_tb" set="VIS" value="Time" />
-                            <textbox id="Time_tb" context="clipboard" class="plain" name="Time" maxlength="3" size="3" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Time_tb" context="clipboard" class="plain" name="Time" maxlength="3" size="3" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Tech" control="Tech_tb" set="VIS" value="Tech" />
-                            <textbox id="Tech_tb" context="clipboard" class="plain" name="Tech" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Tech_tb" context="clipboard" class="plain" name="Tech" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="File" control="File_tb" set="COM" value="File" />
-                            <textbox id="File_tb" context="clipboard" class="plain" name="File" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="File_tb" context="clipboard" class="plain" name="File" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="Type" control="Type_tbmfhd" set="AUT MFHD" value="Type" />
-                            <textbox id="Type_tbmfhd" context="clipboard" class="plain" name="Type" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Type_tbmfhd" context="clipboard" class="plain" name="Type" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="ELvl" control="ELvl_tbmfhd" set="AUT MFHD" value="ELvl" />
-                            <textbox id="ELvl_tbmfhd" context="clipboard" class="plain" name="ELvl" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="ELvl_tbmfhd" context="clipboard" class="plain" name="ELvl" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Item" control="Item_tbmfhd" set="AUT MFHD" value="Item" />
-                            <textbox id="Item_tbmfhd" context="clipboard" class="plain" name="Item" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Item_tbmfhd" context="clipboard" class="plain" name="Item" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="GeoDiv" control="GeoDiv_tb" set="AUT" value="GeoDiv" />
-                            <textbox id="GeoDiv_tb" context="clipboard" class="plain" name="GeoDiv" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="GeoDiv_tb" context="clipboard" class="plain" name="GeoDiv" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Roman" control="Roman_tb" set="AUT" value="Roman" />
-                            <textbox id="Roman_tb" context="clipboard" class="plain" name="Roman" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Roman_tb" context="clipboard" class="plain" name="Roman" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="CatLang" control="CatLang_tb" set="AUT" value="CatLang" />
-                            <textbox id="CatLang_tb" context="clipboard" class="plain" name="CatLang" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="CatLang_tb" context="clipboard" class="plain" name="CatLang" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="Kind" control="Kind_tb" set="AUT" value="Kind" />
-                            <textbox id="Kind_tb" context="clipboard" class="plain" name="Kind" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Kind_tb" context="clipboard" class="plain" name="Kind" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Rules" control="Rules_tb" set="AUT" value="Rules" />
-                            <textbox id="Rules_tb" context="clipboard" class="plain" name="Rules" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Rules_tb" context="clipboard" class="plain" name="Rules" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="SHSys" control="SHSys_tb" set="AUT" value="SHSys" />
-                            <textbox id="SHSys_tb" context="clipboard" class="plain" name="SHSys" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="SHSys_tb" context="clipboard" class="plain" name="SHSys" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="SerType" control="SerType_tb" set="AUT" value="SerType" />
-                            <textbox id="SerType_tb" context="clipboard" class="plain" name="SerType" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="SerType_tb" context="clipboard" class="plain" name="SerType" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="SerNum" control="SerNum_tb" set="AUT" value="SerNum" />
-                            <textbox id="SerNum_tb" context="clipboard" class="plain" name="SerNum" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="SerNum_tb" context="clipboard" class="plain" name="SerNum" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="HeadMain" control="HeadMain_tb" set="AUT" value="HeadMain" />
-                            <textbox id="HeadMain_tb" context="clipboard" class="plain" name="HeadMain" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="HeadMain_tb" context="clipboard" class="plain" name="HeadMain" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="Subj" control="Subj_tb" set="AUT" value="Subj" />
-                            <textbox id="Subj_tb" context="clipboard" class="plain" name="Subj" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Subj_tb" context="clipboard" class="plain" name="Subj" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="HeadSer" control="HeadSer_tb" set="AUT" value="HeadSer" />
-                            <textbox id="HeadSer_tb" context="clipboard" class="plain" name="HeadSer" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="HeadSer_tb" context="clipboard" class="plain" name="HeadSer" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="TypeSubd" control="TypeSubd_tb" set="AUT" value="TypeSubd" />
-                            <textbox id="TypeSubd_tb" context="clipboard" class="plain" name="TypeSubd" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="TypeSubd_tb" context="clipboard" class="plain" name="TypeSubd" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="TypeGov" control="TypeGov_tb" set="AUT" value="TypeGov" />
-                            <textbox id="TypeGov_tb" context="clipboard" class="plain" name="TypeGov" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="TypeGov_tb" context="clipboard" class="plain" name="TypeGov" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="RefEval" control="RefEval_tb" set="AUT" value="RefEval" />
-                            <textbox id="RefEval_tb" context="clipboard" class="plain" name="RefEval" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="RefEval_tb" context="clipboard" class="plain" name="RefEval" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="RecUpd" control="RecUpd_tb" set="AUT" value="RecUpd" />
-                            <textbox id="RecUpd_tb" context="clipboard" class="plain" name="RecUpd" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="RecUpd_tb" context="clipboard" class="plain" name="RecUpd" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
                         <row>
                             <label name="NameDiff" control="NameDiff_tb" set="AUT" value="NameDiff" />
-                            <textbox id="NameDiff_tb" context="clipboard" class="plain" name="NameDiff" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="NameDiff_tb" context="clipboard" class="plain" name="NameDiff" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="Level" control="Level_tb" set="AUT" value="Level" />
-                            <textbox id="Level_tb" context="clipboard" class="plain" name="Level" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="Level_tb" context="clipboard" class="plain" name="Level" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="ModRec" control="ModRec_tb" set="AUT" value="ModRec" />
-                            <textbox id="ModRec_tb" context="clipboard" class="plain" name="ModRec" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="ModRec_tb" context="clipboard" class="plain" name="ModRec" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                             <label name="CatSrc" control="CatSrc_tb" set="AUT" value="CatSrc" />
-                            <textbox id="CatSrc_tb" context="clipboard" class="plain" name="CatSrc" maxlength="1" size="1" onkeypress="netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
+                            <textbox id="CatSrc_tb" context="clipboard" class="plain" name="CatSrc" maxlength="1" size="1" onkeypress="if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); }" oninput="updateFixedFields(this);" onfocus="this.select();"/>
                         </row>
 
                     </rows>
@@ -258,7 +258,7 @@
 </groupbox>
 
 <hbox hidden="true" id="text-editor" flex="1">
-    <xhtml:textarea rows="50" cols='100' onkeypress="if (event.charCode == 115 &amp;&amp; event.ctrlKey &amp;&amp; $('symbol-panel')) { setNod(tab); $('symbol-panel').openPopup(tab, 'after_pointer'); } else { netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect'); if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); } }" context="clipboard" id="text-editor-box"></xhtml:textarea>
+    <xhtml:textarea rows="50" cols='100' onkeypress="if (event.charCode == 115 &amp;&amp; event.ctrlKey &amp;&amp; $('symbol-panel')) { setNod(tab); $('symbol-panel').openPopup(tab, 'after_pointer'); } else {if (!(event.altKey || event.ctrlKey || event.metaKey)) { oils_lock_page(); } }" context="clipboard" id="text-editor-box"></xhtml:textarea>
 </hbox>
 
 <grid name="authority-marc-template" hidden="true">
@@ -272,7 +272,7 @@
 </grid>
 
 <popupset>
-    <popup id="recordTypeMenu" position="after_start">
+    <menupopup id="recordTypeMenu" position="after_start">
         <menuitem label="BKS" oncommand="changeFFEditor('BKS');"/>
         <menuitem label="SER" oncommand="changeFFEditor('SER');"/>
         <menuitem label="VIS" oncommand="changeFFEditor('VIS');"/>
@@ -282,7 +282,7 @@
         <menuitem label="REC" oncommand="changeFFEditor('REC');"/>
         <menuitem label="COM" oncommand="changeFFEditor('COM');"/>
         <menuitem label="MFHD" oncommand="changeFFEditor('MFHD');"/>
-    </popup>
+    </menupopup>
 </popupset>
 
 </window>
diff --git a/Open-ILS/xul/staff_client/server/cat/record_buckets.js b/Open-ILS/xul/staff_client/server/cat/record_buckets.js
index 6d11ca1..edea1b7 100644
--- a/Open-ILS/xul/staff_client/server/cat/record_buckets.js
+++ b/Open-ILS/xul/staff_client/server/cat/record_buckets.js
@@ -32,8 +32,6 @@ cat.record_buckets = function (params) {
 };
 
 cat.record_buckets.pick_file = function (defaultFileName) {
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
     var nsIFilePicker = Components.interfaces.nsIFilePicker;
     var fp = Components.classes["@mozilla.org/filepicker;1"].createInstance( nsIFilePicker );
 
@@ -53,7 +51,6 @@ cat.record_buckets.pick_file = function (defaultFileName) {
 
 cat.record_buckets.export_records = function(obj, output_type) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         obj.list2.select_all();
         obj.data.stash_retrieve();
         JSAN.use('util.functional');
@@ -693,7 +690,6 @@ cat.record_buckets.prototype = {
                                     }
                                 );
 
-                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                 var top_xml = '<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1" >';
                                 top_xml += '<description>' + $("catStrings").getString('staff.cat.record_buckets.delete_records.xml1') + '</description>';
                                 top_xml += '<hbox>';
@@ -712,11 +708,11 @@ cat.record_buckets.prototype = {
                                 xml += '</tr><tr valign="top">';
                                 for (var i = 0; i < record_ids.length; i++) {
                                     xml += '<td nowrap="nowrap"><iframe src="' + urls.XUL_BIB_BRIEF; 
-                                    xml += '?docid=' + record_ids[i] + '"/></td>';
+                                    xml += '?docid=' + record_ids[i] + '" oils_force_external="true"/></td>';
                                 }
                                 xml += '</tr><tr valign="top">';
                                 for (var i = 0; i < record_ids.length; i++) {
-                                    xml += '<td nowrap="nowrap"><iframe style="min-height: 1000px; min-width: 300px;" flex="1" src="' + urls.XUL_MARC_VIEW + '?docid=' + record_ids[i] + ' "/></td>';
+                                    xml += '<td nowrap="nowrap"><iframe style="min-height: 1000px; min-width: 300px;" flex="1" src="' + urls.XUL_MARC_VIEW + '?docid=' + record_ids[i] + ' " oils_force_external="true"/></td>';
                                 }
                                 xml += '</tr></table></form>';
                                 //obj.data.temp_merge_top = top_xml; obj.data.stash('temp_merge_top');
@@ -781,14 +777,14 @@ cat.record_buckets.prototype = {
                                 for (var i = 0; i < docids.length; i++) {
                                     var doc_id = docids[i];
                                     if (seen[doc_id]) continue; seen[doc_id] = true;
-                                    var opac_url = xulG.url_prefix( urls.opac_rdetail ) + doc_id;
+                                    var opac_url = xulG.url_prefix('opac_rdetail') + doc_id;
                                     var content_params = { 
                                         'session' : ses(),
                                         'authtime' : ses('authtime'),
                                         'opac_url' : opac_url
                                     };
                                     xulG.new_tab(
-                                        xulG.url_prefix(urls.XUL_OPAC_WRAPPER), 
+                                        xulG.url_prefix('XUL_OPAC_WRAPPER'), 
                                         {'tab_name':$("catStrings").getString('staff.cat.record_buckets.cmd_sel_opac.tab_name')}, 
                                         content_params
                                     );
diff --git a/Open-ILS/xul/staff_client/server/cat/record_buckets.xul b/Open-ILS/xul/staff_client/server/cat/record_buckets.xul
index 18454f2..2682425 100644
--- a/Open-ILS/xul/staff_client/server/cat/record_buckets.xul
+++ b/Open-ILS/xul/staff_client/server/cat/record_buckets.xul
@@ -35,8 +35,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
                 /* ugly hack so we don't have to upgrade the chrome for quick buckets */
                 if (typeof xulG == 'undefined') location.href = String(location.href).replace(/record_buckets.xul/,'record_buckets_quick.xul');
 
diff --git a/Open-ILS/xul/staff_client/server/cat/record_buckets_quick.xul b/Open-ILS/xul/staff_client/server/cat/record_buckets_quick.xul
index e1ffdee..d2160db 100644
--- a/Open-ILS/xul/staff_client/server/cat/record_buckets_quick.xul
+++ b/Open-ILS/xul/staff_client/server/cat/record_buckets_quick.xul
@@ -35,7 +35,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/cat/spine_labels.js b/Open-ILS/xul/staff_client/server/cat/spine_labels.js
index c952bc9..fe33321 100644
--- a/Open-ILS/xul/staff_client/server/cat/spine_labels.js
+++ b/Open-ILS/xul/staff_client/server/cat/spine_labels.js
@@ -1,6 +1,5 @@
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -504,7 +503,6 @@
 
         function preview(idx) {
             try {
-                    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                     var pt = Number( $('pt').value );  /* font size */
                     if (!pt) {
                         pt = g.data.hash.aous['cat.label.font.size'] || 10;
@@ -604,7 +602,6 @@
                 'title' : $("catStrings").getString('staff.cat.spine_labels.preview.title'),
                 'on_url_load' : function(b) { 
                     try { 
-                        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                         if (typeof w.xulG.written == 'undefined') {
                             w.xulG.written = true;
                             w.g.browser.get_content().document.write(html);
diff --git a/Open-ILS/xul/staff_client/server/cat/util.js b/Open-ILS/xul/staff_client/server/cat/util.js
index 75a3704..91b99cc 100644
--- a/Open-ILS/xul/staff_client/server/cat/util.js
+++ b/Open-ILS/xul/staff_client/server/cat/util.js
@@ -159,7 +159,6 @@ cat.util.transfer_copies = function(params) {
             alert($("catStrings").getString('staff.cat.util.transfer_copies.unmarked_volume_alert'));
             return;
         }
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
         var xml = '<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1" style="overflow: auto">';
         if (!params.message) {
             params.message = $("catStrings").getFormattedString('staff.cat.util.transfer_copies.params_message', [data.hash.aou[ params.owning_lib ].shortname(), params.volume_label]);
@@ -172,7 +171,7 @@ cat.util.transfer_copies = function(params) {
         xml += '<hbox><button label="' + $("catStrings").getString('staff.cat.util.transfer_copies.transfer.label')+ '" name="fancy_submit"/>';
         xml += '<button label="' + $("catStrings").getString('staff.cat.util.transfer_copies.cancel.label');
         xml += '" accesskey="'+ $("catStrings").getString('staff.cat.util.transfer_copies.cancel.accesskey') +'" name="fancy_cancel"/></hbox>';
-        xml += '<iframe style="overflow: scroll" flex="1" src="' + urls.XUL_BIB_BRIEF + '?docid=' + params.docid + '"/>';
+        xml += '<iframe style="overflow: scroll" flex="1" src="' + urls.XUL_BIB_BRIEF + '?docid=' + params.docid + '" oils_force_external="true"/>';
         xml += '</vbox>';
         //data.temp_transfer = xml; data.stash('temp_transfer');
         JSAN.use('util.window'); var win = new util.window();
@@ -231,7 +230,7 @@ cat.util.spawn_spine_editor = function(selection_list) {
     try {
         JSAN.use('util.functional');
         xulG.new_tab(
-            xulG.url_prefix( urls.XUL_SPINE_LABEL ),
+            xulG.url_prefix('XUL_SPINE_LABEL'),
             { 'tab_name' : $("catStrings").getString('staff.cat.util.spine_editor.tab_name') },
             {
                 'barcodes' : util.functional.map_list( selection_list, function(o){return o.barcode;}) 
@@ -264,14 +263,14 @@ cat.util.show_in_opac = function(selection_list) {
                 continue;
             }
             seen[doc_id] = true;
-            var opac_url = xulG.url_prefix( urls.opac_rdetail ) + doc_id;
+            var opac_url = xulG.url_prefix('opac_rdetail') + doc_id;
             var content_params = { 
                 'session' : ses(),
                 'authtime' : ses('authtime'),
                 'opac_url' : opac_url,
             };
             xulG.new_tab(
-                xulG.url_prefix(urls.XUL_OPAC_WRAPPER), 
+                xulG.url_prefix('XUL_OPAC_WRAPPER'), 
                 {'tab_name':$('catStrings').getString('staff.cat.util.show_in_opac.retrieving_title')}, 
                 content_params
             );
@@ -299,7 +298,7 @@ cat.util.add_copies_to_bucket = function(selection_list) {
     );
     data.stash('cb_temp_copy_ids');
     win.open( 
-        xulG.url_prefix(urls.XUL_COPY_BUCKETS_QUICK),
+        xulG.url_prefix('XUL_COPY_BUCKETS_QUICK'),
         '_blank',
         'chrome,resizable,center'
     );
@@ -322,7 +321,7 @@ cat.util.add_titles_to_bucket = function(record_ids) {
     }
     if (filtered_record_ids.length > 0) {
         win.open(
-            xulG.url_prefix(urls.XUL_RECORD_BUCKETS_QUICK),
+            xulG.url_prefix('XUL_RECORD_BUCKETS_QUICK'),
             '_blank',
             'chrome,resizable,modal,center',
             {
@@ -618,7 +617,7 @@ cat.util.fast_item_add = function(doc_id,cn_label,cp_barcode) {
         var unified_interface = String( data.hash.aous['ui.unified_volume_copy_editor'] ) == 'true';
         if (unified_interface) {
             var horizontal_interface = String( data.hash.aous['ui.cat.volume_copy_editor.horizontal'] ) == 'true';
-            var url = window.xulG.url_prefix( horizontal_interface ? urls.XUL_VOLUME_COPY_CREATOR_HORIZONTAL : urls.XUL_VOLUME_COPY_CREATOR );
+            var url = window.xulG.url_prefix( horizontal_interface ? 'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : 'XUL_VOLUME_COPY_CREATOR' );
             var w = xulG.set_tab(
                 url,
                 {
@@ -672,7 +671,7 @@ cat.util.edit_new_brsrc = function(brsrc_list) {
         xulG.resultant_brsrc = brsrc_list.map(function(o) { return o[0]; });
         xulG.new_tab(
             urls.XUL_BROWSER + "?url=" + window.escape(
-                xulG.url_prefix("/eg/conify/global/booking/resource")
+                xulG.url_prefix("BOOKING_RESOURCE")
             ), {
                 "tab_name": offlineStrings.getString(
                     "menu.cmd_booking_resource.tab"
@@ -760,7 +759,7 @@ cat.util.batch_edit_volumes = function(fleshed_volumes) {
         }
 
         var my_xulG = win.open(
-            xulG.url_prefix(urls.XUL_VOLUME_EDITOR),
+            xulG.url_prefix('XUL_VOLUME_EDITOR'),
             title,
             'chrome,modal,resizable',
             { 'volumes' : clone_list( fleshed_volumes ) }
@@ -1185,7 +1184,7 @@ cat.util.mark_for_overlay = function(doc_id,doc_mvr) {
                 }
 
                 if (ev.button == 0 /* left click, spawn opac */) {
-                    var opac_url = xulG.url_prefix( urls.opac_rdetail )
+                    var opac_url = xulG.url_prefix('opac_rdetail')
                         + data[data_key];
                     var content_params = {
                         'session' : ses(),
@@ -1193,7 +1192,7 @@ cat.util.mark_for_overlay = function(doc_id,doc_mvr) {
                         'opac_url' : opac_url,
                     };
                     xulG.new_tab(
-                        xulG.url_prefix(urls.XUL_OPAC_WRAPPER),
+                        xulG.url_prefix('XUL_OPAC_WRAPPER'),
                         {'tab_name':'Retrieving title...'},
                         content_params
                     );
diff --git a/Open-ILS/xul/staff_client/server/cat/volume_buckets.xul b/Open-ILS/xul/staff_client/server/cat/volume_buckets.xul
index c9737b8..59c1f54 100644
--- a/Open-ILS/xul/staff_client/server/cat/volume_buckets.xul
+++ b/Open-ILS/xul/staff_client/server/cat/volume_buckets.xul
@@ -35,7 +35,6 @@
     
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/cat/volume_copy_creator.js b/Open-ILS/xul/staff_client/server/cat/volume_copy_creator.js
index 913fef6..3f0fd0b 100644
--- a/Open-ILS/xul/staff_client/server/cat/volume_copy_creator.js
+++ b/Open-ILS/xul/staff_client/server/cat/volume_copy_creator.js
@@ -18,7 +18,6 @@ function my_init() {
         /***********************************************************************************************************/
         /* Initial setup */
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
@@ -1212,14 +1211,14 @@ g.stash_and_close = function(param) {
             xulG.reload_opac();
         }
         if (xul_param('load_opac_when_done')) {
-            var opac_url = xulG.url_prefix( urls.opac_rdetail ) + g.doc_id;
+            var opac_url = xulG.url_prefix('opac_rdetail') + g.doc_id;
             var content_params = {
                 'session' : ses(),
                 'authtime' : ses('authtime'),
                 'opac_url' : opac_url
             };
             xulG.set_tab(
-                xulG.url_prefix(urls.XUL_OPAC_WRAPPER),
+                xulG.url_prefix('XUL_OPAC_WRAPPER'),
                 {
                     'tab_name':'Retrieving title...',
                     'on_tab_load' : function(cw) {
@@ -1244,7 +1243,6 @@ g.stash_and_close = function(param) {
 
 g.load_prefs = function() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
         JSAN.use('util.file'); var file = new util.file('volume_copy_creator.prefs');
         if (file._file.exists()) {
             var prefs = file.get_object(); file.close();
@@ -1275,7 +1273,6 @@ g.load_prefs = function() {
 
 g.save_prefs = function () {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
         JSAN.use('util.file'); var file = new util.file('volume_copy_creator.prefs');
         file.set_object(
             {
diff --git a/Open-ILS/xul/staff_client/server/cat/volume_copy_editor.js b/Open-ILS/xul/staff_client/server/cat/volume_copy_editor.js
index a0dc8c1..b9bf6a7 100644
--- a/Open-ILS/xul/staff_client/server/cat/volume_copy_editor.js
+++ b/Open-ILS/xul/staff_client/server/cat/volume_copy_editor.js
@@ -3,7 +3,6 @@ var g = {};
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/cat/volume_copy_editor.xul b/Open-ILS/xul/staff_client/server/cat/volume_copy_editor.xul
index 911c032..7838eff 100644
--- a/Open-ILS/xul/staff_client/server/cat/volume_copy_editor.xul
+++ b/Open-ILS/xul/staff_client/server/cat/volume_copy_editor.xul
@@ -43,7 +43,7 @@
     <vbox flex="1">
         <vbox id="top_pane" flex="1" oils_persist="height">
             <hbox id="template_bar_holder"/>
-            <browser id="volume_pane" flex="1" />
+            <browser id="volume_pane" flex="1" oils_force_external="true" />
         </vbox>
         <splitter
             collapse="after"
@@ -54,7 +54,7 @@
             <grippy/>
         </splitter>
         <vbox id="bottom_pane" flex="1" oils_persist="height">
-            <browser id="item_pane" flex="1" />
+            <browser id="item_pane" flex="1" oils_force_external="true" />
             <hbox id="bottom_bar"/>
         </vbox>
     </vbox>
diff --git a/Open-ILS/xul/staff_client/server/cat/volume_copy_editor_horiz.xul b/Open-ILS/xul/staff_client/server/cat/volume_copy_editor_horiz.xul
index b500ab4..ec03b1a 100644
--- a/Open-ILS/xul/staff_client/server/cat/volume_copy_editor_horiz.xul
+++ b/Open-ILS/xul/staff_client/server/cat/volume_copy_editor_horiz.xul
@@ -45,7 +45,7 @@
     <hbox flex="0" id="template_bar_holder"/>
     <hbox flex="1">
         <vbox id="top_pane" flex="1" oils_persist="width">
-            <browser id="volume_pane" flex="1" />
+            <browser id="volume_pane" flex="1" oils_force_external="true" />
         </vbox>
         <splitter
             collapse="after"
@@ -56,7 +56,7 @@
             <grippy/>
         </splitter>
         <vbox id="bottom_pane" flex="1" oils_persist="width">
-            <browser id="item_pane" flex="1" />
+            <browser id="item_pane" flex="1" oils_force_external="true" />
             <hbox id="bottom_bar"/>
         </vbox>
     </hbox>
diff --git a/Open-ILS/xul/staff_client/server/cat/volume_editor.js b/Open-ILS/xul/staff_client/server/cat/volume_editor.js
index d65bd43..d520479 100644
--- a/Open-ILS/xul/staff_client/server/cat/volume_editor.js
+++ b/Open-ILS/xul/staff_client/server/cat/volume_editor.js
@@ -7,7 +7,6 @@ var xulG = {};
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/cat/z3950.js b/Open-ILS/xul/staff_client/server/cat/z3950.js
index 688f269..cf78b11 100644
--- a/Open-ILS/xul/staff_client/server/cat/z3950.js
+++ b/Open-ILS/xul/staff_client/server/cat/z3950.js
@@ -5,7 +5,6 @@ function $(id) { return document.getElementById(id); }
 if (typeof cat == 'undefined') cat = {};
 cat.z3950 = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
         JSAN.use('util.network'); this.network = new util.network();
     } catch(E) {
@@ -26,7 +25,6 @@ cat.z3950.prototype = {
     'init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             JSAN.use('util.widgets');
 
             var obj = this;
@@ -151,7 +149,6 @@ cat.z3950.prototype = {
                                         n.setAttribute('toggle','1');
                                         n.setAttribute('label', $("catStrings").getString('staff.cat.z3950.results_view.label'));
                                         n.setAttribute('accesskey', $("catStrings").getString('staff.cat.z3950.results_view.accesskey'));
-                                        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                                         var f = get_contentWindow(document.getElementById('marc_frame'));
                                         var retrieve_id = n.getAttribute('retrieve_id');
                                         var result_idx = retrieve_id.split('-')[0];
@@ -184,14 +181,14 @@ cat.z3950.prototype = {
                                 try {
                                     var doc_id = obj.controller.view.mark_overlay.getAttribute('doc_id');
                                     if (doc_id) {
-                                        var opac_url = xulG.url_prefix( urls.opac_rdetail ) + doc_id;
+                                        var opac_url = xulG.url_prefix('opac_rdetail') + doc_id;
                                         var content_params = { 
                                             'session' : ses(),
                                             'authtime' : ses('authtime'),
                                             'opac_url' : opac_url,
                                         };
                                         xulG.new_tab(
-                                                     xulG.url_prefix(urls.XUL_OPAC_WRAPPER), 
+                                                     xulG.url_prefix('XUL_OPAC_WRAPPER'), 
                                                      {'tab_name': $("catStrings").getString('staff.cat.z3950.replace_tab_with_opac.tab_name')}, 
                                                      content_params
                                                      );
@@ -766,14 +763,14 @@ cat.z3950.prototype = {
     },
 
     'replace_tab_with_opac' : function(doc_id) {
-        var opac_url = xulG.url_prefix( urls.opac_rdetail ) + doc_id;
+        var opac_url = xulG.url_prefix('opac_rdetail') + doc_id;
         var content_params = { 
             'session' : ses(),
             'authtime' : ses('authtime'),
             'opac_url' : opac_url,
         };
         xulG.set_tab(
-            xulG.url_prefix(urls.XUL_OPAC_WRAPPER), 
+            xulG.url_prefix('XUL_OPAC_WRAPPER'), 
             {'tab_name': $("catStrings").getString('staff.cat.z3950.replace_tab_with_opac.tab_name')}, 
             content_params
         );
@@ -881,7 +878,7 @@ cat.z3950.prototype = {
 
         if ( $('marc_editor').checked ) {
             xulG.new_tab(
-                xulG.url_prefix(urls.XUL_MARC_EDIT), 
+                xulG.url_prefix('XUL_MARC_EDIT'), 
                 { 'tab_name' : 'MARC Editor' }, 
                 { 
                     'marc_control_number_identifier': obj.data.hash.aous['cat.marc_control_number_identifier'] || 'Set cat.marc_control_number_identifier in Library Settings',
@@ -908,7 +905,6 @@ cat.z3950.prototype = {
 
     'confirm_overlay' : function(record_ids) {
         var obj = this; // JSAN.use('OpenILS.data'); var data = new OpenILS.data(); data.init({'via':'stash'});
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
         var top_xml = '<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1" >';
         top_xml += '<description>'+$("catStrings").getString('staff.cat.z3950.confirm_overlay.description')+'</description>';
         top_xml += '<hbox><button id="lead" disabled="false" label="'+$("catStrings").getString('staff.cat.z3950.confirm_overlay.lead.label')+'" name="fancy_submit"';
@@ -920,11 +916,11 @@ cat.z3950.prototype = {
         xml += '<table width="100%"><tr valign="top">';
         for (var i = 0; i < record_ids.length; i++) {
             xml += '<td nowrap="nowrap"><iframe src="' + urls.XUL_BIB_BRIEF; 
-            xml += '?docid=' + record_ids[i] + '"/></td>';
+            xml += '?docid=' + record_ids[i] + '" oils_force_external="true"/></td>';
         }
         xml += '</tr><tr valign="top">';
         for (var i = 0; i < record_ids.length; i++) {
-            xml += '<td nowrap="nowrap"><iframe style="min-height: 1000px; min-width: 300px;" flex="1" src="' + urls.XUL_MARC_VIEW + '?docid=' + record_ids[i] + ' "/></td>';
+            xml += '<td nowrap="nowrap"><iframe style="min-height: 1000px; min-width: 300px;" flex="1" src="' + urls.XUL_MARC_VIEW + '?docid=' + record_ids[i] + ' " oils_force_external="true"/></td>';
         }
         xml += '</tr></table></form>';
         // data.temp_merge_top = top_xml; data.stash('temp_merge_top');
@@ -1044,7 +1040,7 @@ cat.z3950.prototype = {
 
         if ( $('marc_editor').checked ) {
             xulG.new_tab(
-                xulG.url_prefix(urls.XUL_MARC_EDIT), 
+                xulG.url_prefix('XUL_MARC_EDIT'), 
                 { 'tab_name' : $("catStrings").getString('staff.cat.z3950.spawn_marc_editor_for_overlay.tab_name') },
                 { 
                     'record' : { 'marc' : my_marcxml },
@@ -1111,7 +1107,6 @@ cat.z3950.prototype = {
                     }
                 }
             */
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             JSAN.use('util.file'); var file = new util.file('z3950_store');
             if (file._file.exists()) {
                 var creds = file.get_object(); file.close();
@@ -1145,7 +1140,6 @@ cat.z3950.prototype = {
                 }
             }
             obj.creds.version = obj.creds_version;
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             JSAN.use('util.file'); var file = new util.file('z3950_store');
             file.set_object(obj.creds);
             file.close();
diff --git a/Open-ILS/xul/staff_client/server/cat/z3950.xul b/Open-ILS/xul/staff_client/server/cat/z3950.xul
index 32f9a9e..42fa78d 100644
--- a/Open-ILS/xul/staff_client/server/cat/z3950.xul
+++ b/Open-ILS/xul/staff_client/server/cat/z3950.xul
@@ -37,7 +37,6 @@
         
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -205,7 +204,7 @@
                     <splitter id="jacket_splitter" collapse="before" oils_persist="state hidden" oils_persist_peers="jacket_image deck"><grippy id="jacket_splitter_grippy" /></splitter>
                     <deck id="deck" flex="1" oils_persist="width">
                         <tree id="results" flex="1" enableColumnDrag="true" seltype="single"/>
-                        <iframe id="marc_frame" src="/xul/server/cat/marc_view.html" flex="1"/>
+                        <iframe id="marc_frame" src="/xul/server/cat/marc_view.html" flex="1" oils_force_external="true"/>
                     </deck>
                 </hbox>
             </groupbox>
diff --git a/Open-ILS/xul/staff_client/server/circ/alternate_copy_summary.js b/Open-ILS/xul/staff_client/server/circ/alternate_copy_summary.js
index d88e7a3..128fd22 100644
--- a/Open-ILS/xul/staff_client/server/circ/alternate_copy_summary.js
+++ b/Open-ILS/xul/staff_client/server/circ/alternate_copy_summary.js
@@ -6,7 +6,6 @@ var hold_list;
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/circ/checkin.xul b/Open-ILS/xul/staff_client/server/circ/checkin.xul
index 046180e..1910e01 100644
--- a/Open-ILS/xul/staff_client/server/circ/checkin.xul
+++ b/Open-ILS/xul/staff_client/server/circ/checkin.xul
@@ -33,7 +33,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( document.getElementById("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/circ/checkin_overlay.xul b/Open-ILS/xul/staff_client/server/circ/checkin_overlay.xul
index f72fcff..1dc7896 100644
--- a/Open-ILS/xul/staff_client/server/circ/checkin_overlay.xul
+++ b/Open-ILS/xul/staff_client/server/circ/checkin_overlay.xul
@@ -42,7 +42,7 @@
 
 
 <popupset id="copy_status_popupset">
-    <popup id="copy_status_actions" position="at_pointer"> 
+    <menupopup id="copy_status_actions" position="at_pointer"> 
         <menuitem command="sel_clip" label="&staff.circ.checkin_overlay.sel_clip.label;" accesskey="&staff.circ.checkin_overlay.sel_clip.accesskey;" />
         <menuitem command="sel_bucket" label="&staff.circ.checkin_overlay.sel_bucket.label;" accesskey="&staff.circ.checkin_overlay.sel_bucket.accesskey;"/>
         <menuitem command="sel_opac" label="&staff.circ.checkin_overlay.sel_opac.label;" accesskey="&staff.circ.checkin_overlay.sel_opac.accesskey;" />
@@ -60,7 +60,7 @@
         <menuseparator />
         <menuitem command="sel_spine" label="&staff.circ.checkin_overlay.sel_spine.label;" accesskey="&staff.circ.checkin_overlay.sel_spine.accesskey;"/>
         <menuitem command="save_columns" label="&staff.circ.checkin_overlay.save_columns.label;"/>
-    </popup>
+    </menupopup>
 </popupset>
 
 <box id="checkin_main" flex="1" orient="vertical" class="my_overflow">
diff --git a/Open-ILS/xul/staff_client/server/circ/checkout.js b/Open-ILS/xul/staff_client/server/circ/checkout.js
index 92bece2..87a2115 100644
--- a/Open-ILS/xul/staff_client/server/circ/checkout.js
+++ b/Open-ILS/xul/staff_client/server/circ/checkout.js
@@ -146,7 +146,6 @@ circ.checkout.prototype = {
                             } else {
                                 params.noncat = 1;
                                 params.noncat_type = obj.controller.view.checkout_menu.value;
-                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                 var r = window.prompt(
                                     document.getElementById('circStrings').getFormattedString('staff.circ.checkout.cmd_checkout_submit.msg', [obj.data.hash.cnct[params.noncat_type].name()]),
                                     '1',
@@ -611,7 +610,7 @@ circ.checkout.prototype = {
                 if(in_barcode.type == 'actor') {
                     // Go to new patron (do not pass go, do not collect $200, do not prompt user)
                     var horizontal_interface = String( obj.data.hash.aous['ui.circ.patron_summary.horizontal'] ) == 'true';
-                    var loc = xulG.url_prefix( horizontal_interface ? urls.XUL_PATRON_HORIZ_DISPLAY : urls.XUL_PATRON_DISPLAY );
+                    var loc = xulG.url_prefix( horizontal_interface ? 'XUL_PATRON_HORIZ_DISPLAY' : 'XUL_PATRON_DISPLAY' );
                     xulG.set_tab( loc, {}, { 'barcode' : in_barcode.barcode } );
                     return;
                 }
diff --git a/Open-ILS/xul/staff_client/server/circ/checkout.xul b/Open-ILS/xul/staff_client/server/circ/checkout.xul
index f959221..75c8a55 100644
--- a/Open-ILS/xul/staff_client/server/circ/checkout.xul
+++ b/Open-ILS/xul/staff_client/server/circ/checkout.xul
@@ -33,7 +33,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( document.getElementById("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/circ/circ_brief.xul b/Open-ILS/xul/staff_client/server/circ/circ_brief.xul
index ef98ce3..0b07021 100644
--- a/Open-ILS/xul/staff_client/server/circ/circ_brief.xul
+++ b/Open-ILS/xul/staff_client/server/circ/circ_brief.xul
@@ -35,7 +35,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( document.getElementById("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/circ/circ_summary.xul b/Open-ILS/xul/staff_client/server/circ/circ_summary.xul
index 269f81a..e39bfde 100644
--- a/Open-ILS/xul/staff_client/server/circ/circ_summary.xul
+++ b/Open-ILS/xul/staff_client/server/circ/circ_summary.xul
@@ -40,7 +40,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') {
                     throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                 }
diff --git a/Open-ILS/xul/staff_client/server/circ/copy_details.xul b/Open-ILS/xul/staff_client/server/circ/copy_details.xul
index 9046ef5..5462794 100644
--- a/Open-ILS/xul/staff_client/server/circ/copy_details.xul
+++ b/Open-ILS/xul/staff_client/server/circ/copy_details.xul
@@ -40,7 +40,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { 
                     throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                 }
diff --git a/Open-ILS/xul/staff_client/server/circ/copy_status.js b/Open-ILS/xul/staff_client/server/circ/copy_status.js
index b19477a..a65f871 100644
--- a/Open-ILS/xul/staff_client/server/circ/copy_status.js
+++ b/Open-ILS/xul/staff_client/server/circ/copy_status.js
@@ -168,7 +168,6 @@ circ.copy_status.prototype = {
                                     n.setAttribute('toggle','1');
                                     n.setAttribute('label', document.getElementById("circStrings").getString('staff.circ.copy_status.list_view.label'));
                                     n.setAttribute('accesskey', document.getElementById("circStrings").getString('staff.circ.copy_status.list_view.accesskey'));
-                                    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                                     obj.controller.view.copy_status_barcode_entry_textbox.focus();
                                     if (obj.selection_list.length == 0) return;
                                     var f = obj.browser.get_content();
@@ -455,7 +454,6 @@ circ.copy_status.prototype = {
                     'cmd_copy_status_upload_file' : [
                         ['command'],
                         function() {
-                            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                             JSAN.use('util.file');
                             var f = new util.file('');
                             var content = f.import_file( { 'title' : document.getElementById('circStrings').getString('staff.circ.copy_status.upload_file.title'), 'not_json' : true } );
@@ -568,9 +566,9 @@ circ.copy_status.prototype = {
                                     var unified_interface = String( obj.data.hash.aous['ui.unified_volume_copy_editor'] ) == 'true';
                                     if (unified_interface) {
                                         var horizontal_interface = String( obj.data.hash.aous['ui.cat.volume_copy_editor.horizontal'] ) == 'true';
-                                        url = window.xulG.url_prefix( horizontal_interface ? urls.XUL_VOLUME_COPY_CREATOR_HORIZONTAL : urls.XUL_VOLUME_COPY_CREATOR );
+                                        url = window.xulG.url_prefix( horizontal_interface ? 'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : 'XUL_VOLUME_COPY_CREATOR' );
                                     } else {
-                                        url = window.xulG.url_prefix( urls.XUL_VOLUME_COPY_CREATOR_ORIGINAL );
+                                        url = window.xulG.url_prefix('XUL_VOLUME_COPY_CREATOR_ORIGINAL');
                                     }
 
                                     var w = xulG.new_tab(
@@ -728,9 +726,9 @@ circ.copy_status.prototype = {
                                     var unified_interface = String( obj.data.hash.aous['ui.unified_volume_copy_editor'] ) == 'true';
                                     if (unified_interface) {
                                         var horizontal_interface = String( obj.data.hash.aous['ui.cat.volume_copy_editor.horizontal'] ) == 'true';
-                                        url = window.xulG.url_prefix( horizontal_interface ? urls.XUL_VOLUME_COPY_CREATOR_HORIZONTAL : urls.XUL_VOLUME_COPY_CREATOR );
+                                        url = window.xulG.url_prefix( horizontal_interface ? 'XUL_VOLUME_COPY_CREATOR_HORIZONTAL' : 'XUL_VOLUME_COPY_CREATOR' );
                                     } else {
-                                        url = window.xulG.url_prefix( urls.XUL_VOLUME_COPY_CREATOR_ORIGINAL );
+                                        url = window.xulG.url_prefix('XUL_VOLUME_COPY_CREATOR_ORIGINAL');
                                     }
 
                                     var w = xulG.new_tab(
@@ -1018,7 +1016,6 @@ circ.copy_status.prototype = {
                                         list.push(map_acn[v]);
                                     }
 
-                                    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                     var xml = '<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1" style="overflow: auto">';
                                     xml += '<description>';
 
@@ -1041,7 +1038,7 @@ circ.copy_status.prototype = {
                                     xml += '" accesskey="';
                                     xml += document.getElementById('circStrings').getString('staff.circ.copy_status.transfer_volume.cancel.accesskey');
                                     xml += '" name="fancy_cancel"/></hbox>';
-                                    xml += '<iframe style="overflow: scroll" flex="1" src="' + urls.XUL_BIB_BRIEF + '?docid=' + obj.data.marked_library.docid + '"/>';
+                                    xml += '<iframe style="overflow: scroll" flex="1" src="' + urls.XUL_BIB_BRIEF + '?docid=' + obj.data.marked_library.docid + '" oils_force_external="true"/>';
                                     xml += '</vbox>';
                                     JSAN.use('OpenILS.data');
                                     //var data = new OpenILS.data(); data.init({'via':'stash'});
@@ -1266,7 +1263,6 @@ circ.copy_status.prototype = {
             var result = obj.network.simple_request('FM_ACP_DETAILS_VIA_BARCODE.authoritative', [ ses(), barcode ]);
             handle_req({'getResultObject':function(){return result;}}); // used to be async
             if (result.copy && document.getElementById('deck').selectedIndex == 1) {
-                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                 var f = obj.browser.get_content();
                 xulG.barcode = result.copy.barcode(); // FIXME: We could pass the already-fetched data, but need to figure out how to manage that and honor Trim List, the whole point of which is to limit memory consumption
                 if (f) {
diff --git a/Open-ILS/xul/staff_client/server/circ/copy_status.xul b/Open-ILS/xul/staff_client/server/circ/copy_status.xul
index 351b01b..89610e3 100644
--- a/Open-ILS/xul/staff_client/server/circ/copy_status.xul
+++ b/Open-ILS/xul/staff_client/server/circ/copy_status.xul
@@ -33,7 +33,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') {
                     throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                 }
diff --git a/Open-ILS/xul/staff_client/server/circ/copy_status_overlay.xul b/Open-ILS/xul/staff_client/server/circ/copy_status_overlay.xul
index 909b547..200ea9e 100644
--- a/Open-ILS/xul/staff_client/server/circ/copy_status_overlay.xul
+++ b/Open-ILS/xul/staff_client/server/circ/copy_status_overlay.xul
@@ -10,7 +10,7 @@
 <commandset id="copy_status_cmds" />
 
 <popupset id="copy_status_popupset">
-    <popup id="copy_status_actions" position="at_pointer"> 
+    <menupopup id="copy_status_actions" position="at_pointer"> 
         <menuitem command="sel_clip" label="&staff.circ.copy_status_overlay.sel_clip.label;" accesskey="&staff.circ.copy_status_overlay.sel_clip.accesskey;" />
         <menuitem command="sel_bucket" label="&staff.circ.copy_status_overlay.sel_bucket.label;" accesskey="&staff.circ.copy_status_overlay.sel_bucket.accesskey;"/>
         <menuitem command="sel_record_bucket" />
@@ -40,11 +40,11 @@
         <menuitem command="sel_spine" label="&staff.circ.copy_status_overlay.sel_spine.label;" accesskey="&staff.circ.copy_status_overlay.sel_spine.accesskey;"/>
         <menuitem command="cmd_replace_barcode" label="&staff.circ.copy_status_overlay.cmd_replace_barcode.label;" accesskey="&staff.circ.copy_status_overlay.cmd_replace_barcode.accesskey;"/>
         <menuitem command="save_columns" label="&staff.circ.copy_status_overlay.save_columns.label;"/>
-    </popup>
+    </menupopup>
 </popupset>
 
 <popupset id="copy_cat_status_popupset">
-    <popup id="copy_cat_status_actions" position="at_pointer"> 
+    <menupopup id="copy_cat_status_actions" position="at_pointer"> 
         <menuitem command="sel_clip" label="&staff.circ.copy_status_overlay.sel_clip.label;" accesskey="&staff.circ.copy_status_overlay.sel_clip.accesskey;" />
         <menuitem command="sel_bucket" label="&staff.circ.copy_status_overlay.sel_bucket.label;" accesskey="&staff.circ.copy_status_overlay.sel_bucket.accesskey;"/>
         <menuitem command="sel_record_bucket" />
@@ -73,7 +73,7 @@
         <menuitem command="sel_spine" label="&staff.circ.copy_status_overlay.sel_spine.label;" accesskey="&staff.circ.copy_status_overlay.sel_spine.accesskey;"/>
         <menuitem command="cmd_replace_barcode" label="&staff.circ.copy_status_overlay.cmd_replace_barcode.label;" accesskey="&staff.circ.copy_status_overlay.cmd_replace_barcode.accesskey;"/>
         <menuitem command="save_columns" label="&staff.circ.copy_status_overlay.save_columns.label;"/>
-    </popup>
+    </menupopup>
 </popupset>
 
 
@@ -97,7 +97,7 @@
         <hbox id="copy_status_top_ui" />
         <deck id="deck" flex="1">
             <tree id="copy_status_list" flex="1" enableColumnDrag="true" context="copy_status_actions" />
-            <browser id="copy_status_frame" src="" flex="1" autoscroll="false" />
+            <browser id="copy_status_frame" src="" flex="1" autoscroll="false" oils_force_external="true" />
         </deck>
         <hbox id="copy_status_bottom_ui" />
     </groupbox>
diff --git a/Open-ILS/xul/staff_client/server/circ/in_house_use.xul b/Open-ILS/xul/staff_client/server/circ/in_house_use.xul
index a0d27d6..097aeb7 100644
--- a/Open-ILS/xul/staff_client/server/circ/in_house_use.xul
+++ b/Open-ILS/xul/staff_client/server/circ/in_house_use.xul
@@ -32,7 +32,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') {
                     throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                 }
diff --git a/Open-ILS/xul/staff_client/server/circ/missing_pieces.js b/Open-ILS/xul/staff_client/server/circ/missing_pieces.js
index 579726e..bfa696e 100644
--- a/Open-ILS/xul/staff_client/server/circ/missing_pieces.js
+++ b/Open-ILS/xul/staff_client/server/circ/missing_pieces.js
@@ -2,7 +2,6 @@ var error;
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( "The JSAN library object is missing."); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/circ/pre_cat_fields.xul b/Open-ILS/xul/staff_client/server/circ/pre_cat_fields.xul
index eb4cade..046f2b2 100644
--- a/Open-ILS/xul/staff_client/server/circ/pre_cat_fields.xul
+++ b/Open-ILS/xul/staff_client/server/circ/pre_cat_fields.xul
@@ -36,7 +36,6 @@
     <![CDATA[
 
         function my_init() {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (typeof JSAN == 'undefined') {
                 throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
             }
diff --git a/Open-ILS/xul/staff_client/server/circ/print_list_template_editor.js b/Open-ILS/xul/staff_client/server/circ/print_list_template_editor.js
index bdb7279..dab6e2b 100644
--- a/Open-ILS/xul/staff_client/server/circ/print_list_template_editor.js
+++ b/Open-ILS/xul/staff_client/server/circ/print_list_template_editor.js
@@ -4,7 +4,6 @@ dump('entering print_list_template_editor.js\n');
 if (typeof circ == 'undefined') circ = {};
 circ.print_list_template_editor = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
     } catch(E) {
         dump('print_list: ' + E + '\n');
@@ -16,8 +15,6 @@ circ.print_list_template_editor.prototype = {
     'init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
             var obj = this;
 
             JSAN.use('OpenILS.data'); obj.data = new OpenILS.data(); obj.data.init({'via':'stash'});
@@ -412,7 +409,6 @@ circ.print_list_template_editor.prototype = {
         obj.data.print_list_templates[name].type = obj.controller.view.template_type_menu.value;
         obj.data.print_list_templates[name].context = obj.controller.view.template_context_menu.value;
         obj.data.stash( 'print_list_templates' );
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.file'); var file = new util.file('print_list_templates');
         file.set_object(obj.data.print_list_templates); file.close();
         alert(document.getElementById('circStrings').getString('staff.circ.print_list_template.save') + '\n' + js2JSON(obj.data.print_list_templates[name]));
@@ -421,7 +417,6 @@ circ.print_list_template_editor.prototype = {
     'export_templates' : function() {
         try {
             var obj = this;
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             JSAN.use('util.file'); var f = new util.file('');
             f.export_file( { 'title' : document.getElementById('circStrings').getString('staff.circ.print_list_template.save_as'), 'data' : obj.data.print_list_templates } );
 
@@ -433,7 +428,6 @@ circ.print_list_template_editor.prototype = {
     'import_templates' : function() {
         try {
             var obj = this;
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             JSAN.use('util.file'); var f = new util.file('');
             var temp = f.import_file( { 'title' : document.getElementById('circStrings').getString('staff.circ.print_list_template.import') } );
             if (!temp) { return; }
@@ -446,7 +440,7 @@ circ.print_list_template_editor.prototype = {
             obj.data.stash('print_list_templates');
             alert(document.getElementById('circStrings').getFormattedString('staff.circ.print_list_template.import_results', [s]));
             if (xulG) { 
-                xulG.set_tab(xulG.url_prefix(urls.XUL_PRINT_LIST_TEMPLATE_EDITOR), {}, {});
+                xulG.set_tab(xulG.url_prefix('XUL_PRINT_LIST_TEMPLATE_EDITOR'), {}, {});
             } else {
                 alert(document.getElementById('circStrings').getString('staff.circ.print_list_template.reload'));
             }
diff --git a/Open-ILS/xul/staff_client/server/circ/print_list_template_editor.xul b/Open-ILS/xul/staff_client/server/circ/print_list_template_editor.xul
index 0450cfa..f486048 100644
--- a/Open-ILS/xul/staff_client/server/circ/print_list_template_editor.xul
+++ b/Open-ILS/xul/staff_client/server/circ/print_list_template_editor.xul
@@ -33,7 +33,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') {
                     throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                 }
@@ -106,7 +105,7 @@
         <hbox flex="1">
             <groupbox flex="1">
                 <caption label="&staff.circ.print_list.top_ui.preview.label;" />
-                <iframe id="sample" flex="1"/>
+                <iframe id="sample" flex="1" oils_force_external="true"/>
             </groupbox>
             <vbox flex="1">
                 <groupbox flex="1">
diff --git a/Open-ILS/xul/staff_client/server/circ/renew.xul b/Open-ILS/xul/staff_client/server/circ/renew.xul
index 9598d68..300d253 100644
--- a/Open-ILS/xul/staff_client/server/circ/renew.xul
+++ b/Open-ILS/xul/staff_client/server/circ/renew.xul
@@ -33,7 +33,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( document.getElementById("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/circ/renew_overlay.xul b/Open-ILS/xul/staff_client/server/circ/renew_overlay.xul
index c28a3a8..a36e3f8 100644
--- a/Open-ILS/xul/staff_client/server/circ/renew_overlay.xul
+++ b/Open-ILS/xul/staff_client/server/circ/renew_overlay.xul
@@ -13,7 +13,7 @@
 <commandset id="renew_cmds" />
 
 <popupset id="copy_status_popupset">
-    <popup id="copy_status_actions" position="at_pointer"> 
+    <menupopup id="copy_status_actions" position="at_pointer"> 
         <menuitem command="sel_clip" label="&staff.circ.renew_overlay.sel_clip.label;" accesskey="&staff.circ.renew_overlay.sel_clip.accesskey;" />
         <menuitem command="sel_bucket" label="&staff.circ.renew_overlay.sel_bucket.label;" accesskey="&staff.circ.renew_overlay.sel_bucket.accesskey;"/>
         <menuitem command="sel_opac" label="&staff.circ.renew_overlay.sel_opac.label;" accesskey="&staff.circ.renew_overlay.sel_opac.accesskey;" />
@@ -29,7 +29,7 @@
         <menuseparator />
         <menuitem command="sel_spine" label="&staff.circ.renew_overlay.sel_spine.label;" accesskey="&staff.circ.renew_overlay.sel_spine.accesskey;"/>
         <menuitem command="save_columns" label="&staff.circ.renew_overlay.save_columns.label;"/>
-    </popup>
+    </menupopup>
 </popupset>
 
 <box id="renew_main" flex="1" orient="vertical" class="my_overflow">
diff --git a/Open-ILS/xul/staff_client/server/circ/util.js b/Open-ILS/xul/staff_client/server/circ/util.js
index 0158080..3410aa8 100644
--- a/Open-ILS/xul/staff_client/server/circ/util.js
+++ b/Open-ILS/xul/staff_client/server/circ/util.js
@@ -64,7 +64,7 @@ circ.util.show_copy_details = function(copy_id) {
     if (typeof copy_id == 'object' && copy_id != null) copy_id = copy_id.id();
 
     try {
-        var url = xulG.url_prefix( urls.XUL_COPY_DETAILS ); // + '?copy_id=' + copy_id;
+        var url = xulG.url_prefix('XUL_COPY_DETAILS'); // + '?copy_id=' + copy_id;
         var my_xulG = obj.win.open( url, 'show_copy_details', 'chrome,resizable,modal', { 'copy_id' : copy_id, 'new_tab' : xulG.new_tab, 'url_prefix' : xulG.url_prefix } );
 
         if (typeof my_xulG.retrieve_these_patrons == 'undefined') return;
@@ -115,7 +115,7 @@ circ.util.backdate_post_checkin = function(circ_ids) {
     );
 
     try {
-        var url = xulG.url_prefix( urls.XUL_BACKDATE );
+        var url = xulG.url_prefix('XUL_BACKDATE');
         var my_xulG = obj.win.open( url, 'backdate_post_checkin', 'chrome,resizable,modal', { 'circ_ids' : circ_ids } );
 
         return my_xulG;
@@ -136,7 +136,7 @@ circ.util.show_last_few_circs = function(selection_list) {
     for (var i = 0; i < selection_list.length; i++) {
         try {
             if (typeof selection_list[i].copy_id == 'undefined' || selection_list[i].copy_id == null) continue;
-            var url = xulG.url_prefix( urls.XUL_CIRC_SUMMARY ); // + '?copy_id=' + selection_list[i].copy_id + '&count=' + count;
+            var url = xulG.url_prefix('XUL_CIRC_SUMMARY'); // + '?copy_id=' + selection_list[i].copy_id + '&count=' + count;
             var my_xulG = obj.win.open( url, 'show_last_few_circs', 'chrome,resizable,modal', { 'copy_id' : selection_list[i].copy_id, 'new_tab' : xulG.new_tab, 'url_prefix': xulG.url_prefix } );
 
             if (typeof my_xulG.retrieve_these_patrons == 'undefined') continue;
@@ -3957,9 +3957,9 @@ circ.util.find_acq_po = function(session, copy_id) {
                 if (r = openils.Util.readResponse(r)) {
                     if (r.purchase_order()) {
                         var url = urls.XUL_BROWSER + "?url=" +
-                            xulG.url_prefix(
-                                escape(urls.EG_ACQ_PO_VIEW +
-                                    "/" + r.purchase_order() + "/" + r.id())
+                            window.escape(
+                                xulG.url_prefix('EG_ACQ_PO_VIEW/')
+                                    + r.purchase_order() + "/" + r.id()
                             );
                         window.xulG.new_tab(
                             url, {"browser": true}, {
diff --git a/Open-ILS/xul/staff_client/server/index.xhtml b/Open-ILS/xul/staff_client/server/index.xhtml
index 15d77c2e..b0ddccd 100644
--- a/Open-ILS/xul/staff_client/server/index.xhtml
+++ b/Open-ILS/xul/staff_client/server/index.xhtml
@@ -41,9 +41,9 @@
         var search_depth = 0; // 0 = consortium, 1 = system, 2 = library, 3 = sub-library, etc.
         
         if(textbox && textbox.value != "") {
-                var opac_url =  xulG.url_prefix(urls.opac_rresult) + "?rt=keyword&tp=keyword&l=" + home_ou_id + "&d=" + search_depth +"&f=&t=" + escape(textbox.value);
+                var opac_url =  xulG.url_prefix('opac_rresult') + "?rt=keyword&tp=keyword&l=" + home_ou_id + "&d=" + search_depth +"&f=&t=" + escape(textbox.value);
                 if (urls.opac_rresult.match(/\/eg\/opac\/results/)) {
-                    opac_url =  xulG.url_prefix(urls.opac_rresult) + "?query=" + escape(textbox.value);
+                    opac_url =  xulG.url_prefix('opac_rresult') + "?query=" + escape(textbox.value);
                 }
                 var params = {'tab_name':'Catalog'};
                 var content_params = { 'session' : ses(), 'authtime' : ses('authtime'), 'opac_url' : opac_url };
@@ -90,7 +90,7 @@
                         xulG.set_tab_name('Portal');
                 }
                 function jb_open_eg_web_page(path, label) {
-                        var loc = urls.XUL_BROWSER + '?url=' + window.escape(xulG.url_prefix(urls.EG_WEB_BASE) + '/' + path);
+                        var loc = urls.XUL_BROWSER + '?url=' + window.escape(xulG.url_prefix('EG_WEB_BASE') + '/' + path);
 
                         xulG.set_tab( 
                                 loc, 
@@ -99,7 +99,7 @@
                         );
                 }
                 function jb_open_eg_web_page_newtab(path, label) {
-                        var loc = urls.XUL_BROWSER + '?url=' + window.escape(xulG.url_prefix(urls.EG_WEB_BASE) + '/' + path);
+                        var loc = urls.XUL_BROWSER + '?url=' + window.escape(xulG.url_prefix('EG_WEB_BASE') + '/' + path);
 
                         xulG.new_tab( 
                                 loc, 
@@ -203,7 +203,7 @@
                                 jb_open_eg_web_page('vandelay/vandelay', 'Server Settings');
                 }
                 function local_admin_reports(newtab) {
-                        var loc = urls.XUL_BROWSER + '?url=' + window.escape( xulG.url_prefix(urls.XUL_REPORTS) + '?ses=' + ses());
+                        var loc = urls.XUL_BROWSER + '?url=' + window.escape( xulG.url_prefix('XUL_REPORTS') + '?ses=' + ses());
                         params = {'tab_name' : 'Reports', 'browser' : false }
                         content_params = {'no_xulG' : false, 'show_print_button' : false, show_nav_buttons : true }
                         if(newtab)
@@ -247,7 +247,6 @@
                 }
                 function toggle_tpac(mode) {
                     var use_tpac = false;
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     var prefs = Components.classes['@mozilla.org/preferences-service;1'].getService(Components.interfaces['nsIPrefBranch']);
                     try {
                         use_tpac = prefs.getBoolPref('oils.use_tpac');
diff --git a/Open-ILS/xul/staff_client/server/main/data.xul b/Open-ILS/xul/staff_client/server/main/data.xul
index d74676e..f71b54f 100644
--- a/Open-ILS/xul/staff_client/server/main/data.xul
+++ b/Open-ILS/xul/staff_client/server/main/data.xul
@@ -44,17 +44,6 @@
 
         function data_init() {
 
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
-            // XXX: We're reproducing what's in main.js just for a time so we can have this immediately in some environments
-            // without requiring a new staff client build be deployed
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-            var prefs = Components.classes['@mozilla.org/preferences-service;1'].getService(Ci['nsIPrefBranch']);                                             if (prefs.prefHasUserValue('general.useragent.override')) {
-                // don't want an ever-growing useragent
-            } else {
-                prefs.setCharPref('general.useragent.override',navigator.userAgent + ' oils_xulrunner /xul/server/');
-            }
-
             if (typeof JSAN == 'undefined') {
                 throw(document.getElementById("commonStrings").getString('common.jsan.missing'));
             }
@@ -229,7 +218,6 @@
 
             g.open_menu = function() {
                 delete xulG['_sound'];
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 var wm = Components.classes["@mozilla.org/appshell/window-mediator;1"].
                     getService(Components.interfaces.nsIWindowMediator);
                 var eg_main = wm.getMostRecentWindow('eg_main');
@@ -248,7 +236,7 @@
     <groupbox id="data_groupbox" flex="1" class="my_overflow"> 
         <caption id="caption" label="&staff.main.data.loading;"/> 
         <description id="data_progress"/>
-        <iframe id="iframe" />
+        <iframe id="iframe" oils_force_external="true" />
     </groupbox>
 
 </window>
diff --git a/Open-ILS/xul/staff_client/server/main/gen_offline_widgets.xul b/Open-ILS/xul/staff_client/server/main/gen_offline_widgets.xul
index da5873f..9346e72 100644
--- a/Open-ILS/xul/staff_client/server/main/gen_offline_widgets.xul
+++ b/Open-ILS/xul/staff_client/server/main/gen_offline_widgets.xul
@@ -35,8 +35,6 @@
     <![CDATA[
 
         function my_init() {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
             if (typeof JSAN == 'undefined') {
                 throw(document.getElementById('commonStrings').getString('common.jsan.missing'));
             }
@@ -58,8 +56,6 @@
 
         function gen_offline_menus_init() {
 
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
             JSAN.use('util.functional');
 
             save_object('offline_ou_list', build_ou_list());
@@ -96,7 +92,6 @@
         }
 
         function save_object(filename,obj) {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             JSAN.use('util.file'); var file = new util.file(filename);
             file.set_object(obj); file.close();
         }
diff --git a/Open-ILS/xul/staff_client/server/main/simple_auth.xul b/Open-ILS/xul/staff_client/server/main/simple_auth.xul
index f30a319..5dae0ac 100644
--- a/Open-ILS/xul/staff_client/server/main/simple_auth.xul
+++ b/Open-ILS/xul/staff_client/server/main/simple_auth.xul
@@ -40,7 +40,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { 
                     throw( offlineStrings.getString('common.jsan.missing'));
                 }
diff --git a/Open-ILS/xul/staff_client/server/main/ws_info.xul b/Open-ILS/xul/staff_client/server/main/ws_info.xul
index 40ab695..2107895 100644
--- a/Open-ILS/xul/staff_client/server/main/ws_info.xul
+++ b/Open-ILS/xul/staff_client/server/main/ws_info.xul
@@ -40,8 +40,6 @@
             document.getElementById('wsname').disabled = true;
             document.getElementById('wsname').value = document.getElementById('commonStrings').getString('staff.main.gen_offline_widgets.please_wait');
 
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
             if (typeof JSAN == 'undefined') {
                 throw(document.getElementById("commonStrings").getString('common.jsan.missing'));
             }
@@ -186,7 +184,6 @@
                         default: g.error.standard_unexpected_error_alert(document.getElementById('commonStrings').getFormattedString('staff.main.gen_offline_widgets.registration.error', ['1']), robj); break;
                     }
                 } else {
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalPreferencesWrite UniversalBrowserWrite UniversalPreferencesRead UniversalBrowserRead");
                     g.data.ws_info[ xulG.auth.controller.view.server_prompt.value ] = { 
                         'name' : g.my_libs_shortname_hash[ g.ml.value ] + '-' + g.tb.value, 
                         'owning_lib' : g.ml.value,
diff --git a/Open-ILS/xul/staff_client/server/patron/barcode_entry.xul b/Open-ILS/xul/staff_client/server/patron/barcode_entry.xul
index 557995a..bd8f077 100644
--- a/Open-ILS/xul/staff_client/server/patron/barcode_entry.xul
+++ b/Open-ILS/xul/staff_client/server/patron/barcode_entry.xul
@@ -33,7 +33,6 @@
         
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -173,7 +172,7 @@
         function spawn_checkout(barcode) {
             try {
                 var horizontal_interface = String( g.data.hash.aous['ui.circ.patron_summary.horizontal'] ) == 'true';
-                var loc = xulG.url_prefix( horizontal_interface ? urls.XUL_PATRON_HORIZ_DISPLAY : urls.XUL_PATRON_DISPLAY );
+                var loc = xulG.url_prefix( horizontal_interface ? 'XUL_PATRON_HORIZ_DISPLAY' : 'XUL_PATRON_DISPLAY' );
                 if (typeof window.xulG == 'object' && typeof window.xulG.set_tab == 'function') {
                     window.xulG.set_tab( loc, {}, { 'barcode' : barcode } );
                 } else {
diff --git a/Open-ILS/xul/staff_client/server/patron/bill2.js b/Open-ILS/xul/staff_client/server/patron/bill2.js
index fa0a8a0..6c0b7de 100644
--- a/Open-ILS/xul/staff_client/server/patron/bill2.js
+++ b/Open-ILS/xul/staff_client/server/patron/bill2.js
@@ -1,6 +1,5 @@
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
@@ -508,7 +507,6 @@ function init_lists() {
             $('copy_details').setAttribute('disabled', g.bill_list_selection.length == 0);
         },
         'on_click' : function(ev) {
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserRead');
             var row = {}; var col = {}; var nobj = {};
             g.bill_list.node.treeBoxObject.getCellAt(ev.clientX,ev.clientY,row,col,nobj);
             if (row.value == -1) return;
@@ -840,7 +838,6 @@ function apply_payment() {
                 if (no_print_prompting) {
                     if (no_print_prompting.indexOf( "Bill Pay" ) > -1) { return; } // Skip print attempt
                 }
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 g.data.stash_retrieve();
                 var template = 'bill_payment';
                 JSAN.use('patron.util'); JSAN.use('util.functional');
diff --git a/Open-ILS/xul/staff_client/server/patron/bill2.xul b/Open-ILS/xul/staff_client/server/patron/bill2.xul
index 8dba84d..aef8715 100644
--- a/Open-ILS/xul/staff_client/server/patron/bill2.xul
+++ b/Open-ILS/xul/staff_client/server/patron/bill2.xul
@@ -45,14 +45,14 @@
     </commandset>
 
     <popupset>
-        <popup id="actions_popup">
+        <menupopup id="actions_popup">
             <menuitem command="opac" />
             <menuitem command="copy_details" />
             <menuitem command="voidall" />
             <menuitem command="refund" />
             <menuitem command="add" />
             <menuitem command="details" />
-        </popup>
+        </menupopup>
     </popupset>
 
     <vbox flex="1" class="my_overflow">
diff --git a/Open-ILS/xul/staff_client/server/patron/bill_cc_info.xul b/Open-ILS/xul/staff_client/server/patron/bill_cc_info.xul
index ec8aa4a..11297bb 100644
--- a/Open-ILS/xul/staff_client/server/patron/bill_cc_info.xul
+++ b/Open-ILS/xul/staff_client/server/patron/bill_cc_info.xul
@@ -92,7 +92,6 @@
         }
 
         function info_init() {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
             JSAN.errorLevel = "die"; // none, warn, or die
             JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/patron/bill_check_info.xul b/Open-ILS/xul/staff_client/server/patron/bill_check_info.xul
index 0bcbb12..71738ec 100644
--- a/Open-ILS/xul/staff_client/server/patron/bill_check_info.xul
+++ b/Open-ILS/xul/staff_client/server/patron/bill_check_info.xul
@@ -35,7 +35,6 @@
         function $(id) { return document.getElementById(id); }
 
         function info_init() {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
             JSAN.errorLevel = "die"; // none, warn, or die
             JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/patron/bill_details.js b/Open-ILS/xul/staff_client/server/patron/bill_details.js
index 91e21f4..52c4e06 100644
--- a/Open-ILS/xul/staff_client/server/patron/bill_details.js
+++ b/Open-ILS/xul/staff_client/server/patron/bill_details.js
@@ -86,7 +86,6 @@ function retrieve_circ() {
                 if (get_bool(r_circ.phone_renewal() ) ) r += 'PHONE ';
                 $('renewal').value = r || 'No';
 
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 var csb = $('copy_summary_vbox'); while (csb.firstChild) csb.removeChild(csb.lastChild);
                 var copy_summary = document.createElement('iframe'); csb.appendChild(copy_summary);
                 copy_summary.setAttribute('src',urls.XUL_COPY_SUMMARY); // + '?copy_id=' + r_circ.target_copy());
@@ -201,7 +200,6 @@ function retrieve_mp() {
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/patron/bill_history.js b/Open-ILS/xul/staff_client/server/patron/bill_history.js
index 1f7ca40..098a140 100644
--- a/Open-ILS/xul/staff_client/server/patron/bill_history.js
+++ b/Open-ILS/xul/staff_client/server/patron/bill_history.js
@@ -218,7 +218,6 @@ function init_payments_list() {
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/patron/bill_wizard.js b/Open-ILS/xul/staff_client/server/patron/bill_wizard.js
index b1c4d87..b355845 100644
--- a/Open-ILS/xul/staff_client/server/patron/bill_wizard.js
+++ b/Open-ILS/xul/staff_client/server/patron/bill_wizard.js
@@ -93,7 +93,6 @@ function retrieve_patron() {
 
 function patron_bill_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/patron/display.js b/Open-ILS/xul/staff_client/server/patron/display.js
index 9608ebd..7e2a547 100644
--- a/Open-ILS/xul/staff_client/server/patron/display.js
+++ b/Open-ILS/xul/staff_client/server/patron/display.js
@@ -214,7 +214,6 @@ patron.display.prototype = {
                                 {
                                     'patron_id' : obj.patron.id(),
                                     'on_list_change' : function(b) {
-                                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                         obj.summary_window.g.summary.controller.render('patron_checkouts');
                                         obj.summary_window.g.summary.controller.render('patron_standing_penalties');
                                         obj.summary_window.g.summary.controller.render('patron_bill');
@@ -226,7 +225,6 @@ patron.display.prototype = {
                                     'new_patron_tab' : function(a,b) { return xulG.new_patron_tab(a,b); }
                                 }
                             );
-                            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                             obj.items_window = get_contentWindow(frame);
                         }
                     ],
@@ -249,7 +247,7 @@ patron.display.prototype = {
                                     //    if (param_count++ == 0) url += '?'; else url += '&';
                                     //    url += i + '=' + window.escape(p[i]);
                                     //}
-                                    var loc = xulG.url_prefix( urls.XUL_REMOTE_BROWSER ); // + '?url=' + window.escape( url );
+                                    var loc = xulG.url_prefix('XUL_REMOTE_BROWSER'); // + '?url=' + window.escape( url );
                                     xulG.new_tab(
                                         loc, 
                                         {}, 
@@ -296,7 +294,6 @@ patron.display.prototype = {
                                                 JSAN.use('patron.util'); 
                                                 patron.util.work_log_patron_edit(p);
                                                 if (obj.barcode) obj.barcode = p.card().barcode();
-                                                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                                 //obj.summary_window.g.summary.retrieve();
                                                 obj.refresh_all();
                                             } catch(E) {
@@ -420,7 +417,7 @@ patron.display.prototype = {
                         ['command'],
                         function(ev) {
                             openils.XUL.newTabEasy(
-                                "/eg/booking/reservation",
+                                "BOOKING_RESERVATION",
                                 $("offlineStrings").getString(
                                     "menu.cmd_booking_reservation.tab"
                                 ), {
@@ -437,7 +434,7 @@ patron.display.prototype = {
                         ['command'],
                         function(ev) {
                             openils.XUL.newTabEasy(
-                                "/eg/booking/pickup",
+                                "BOOKING_PICKUP",
                                 $("offlineStrings").getString(
                                     "menu.cmd_booking_reservation_pickup.tab"
                                 ), {
@@ -454,7 +451,7 @@ patron.display.prototype = {
                         ['command'],
                         function(ev) {
                             openils.XUL.newTabEasy(
-                                "/eg/booking/return",
+                                "BOOKING_RETURN",
                                 $("offlineStrings").getString(
                                     "menu.cmd_booking_reservation_return.tab"
                                 ), {
@@ -489,7 +486,6 @@ patron.display.prototype = {
                                         'patron_barcode' : obj.patron.card().barcode(),
                                         'on_list_change' : function(h) {
                                             try {
-                                                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                                 obj.summary_window.g.summary.controller.render('patron_holds');
                                             } catch(E) {
                                                 alert(E);
@@ -524,12 +520,10 @@ patron.display.prototype = {
                                     'get_new_session' : function(a) { return xulG.get_new_session(a); },
                                     'new_tab' : function(a,b,c) { return xulG.new_tab(a,b,c); },
                                     'on_money_change' : function(b) {
-                                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                         obj.summary_window.refresh();
                                     }
                                 }
                             );
-                            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                             obj.bill_window = get_contentWindow(f);
                         }
                     ],
@@ -673,7 +667,6 @@ patron.display.prototype = {
                     }
                 }
             );
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             obj.summary_window = get_contentWindow(frame);
 
         } else {
@@ -770,9 +763,6 @@ patron.display.prototype = {
                                                 }
                                             }
                                         );
-                                        netscape.security.PrivilegeManager.enablePrivilege(
-                                            "UniversalXPConnect"
-                                        );
                                         obj.summary_window = get_contentWindow(frame);
                                         obj.patron = obj.summary_window.g.summary.patron;
                                         obj.controller.render('patron_name');
@@ -781,7 +771,6 @@ patron.display.prototype = {
                             }
                         }
                     );
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     obj.search_result = get_contentWindow(list_frame);
                 }
             };
@@ -796,7 +785,6 @@ patron.display.prototype = {
                 {},
                 my_xulG
             );
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             obj.search_window = get_contentWindow(form_frame);
             obj._already_defaulted_once = true;
     },
@@ -805,7 +793,6 @@ patron.display.prototype = {
 
     'refresh_deck' : function(url) {
         var obj = this;
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         for (var i = 0; i < obj.right_deck.node.childNodes.length; i++) {
             try {
                 var f = obj.right_deck.node.childNodes[i];
@@ -850,14 +837,11 @@ patron.display.prototype = {
                     'patron' : obj.patron,
                     'check_stop_checkouts' : function() { return obj.check_stop_checkouts(); },
                     'on_list_change_old' : function(checkout) {
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         var x = obj.summary_window.g.summary.controller.view.patron_checkouts;
                         var n = Number(x.getAttribute('value'));
                         x.setAttribute('value',n+1);
                     },
                     'on_list_change' : function(checkout,is_renewal) {
-                    
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         // Downside here: an extra network call, open-ils.actor.user.checked_out.count.authoritative
                         obj.summary_window.g.summary.controller.render('patron_checkouts');
                         obj.summary_window.g.summary.controller.render('patron_standing_penalties');
@@ -893,7 +877,6 @@ patron.display.prototype = {
                     'url_prefix' : xulG.url_prefix
                 }
             );
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             obj.checkout_window = get_contentWindow(frame);
         } catch(E) {
             alert('Error in spawn_checkout_interface(): ' + E);
@@ -945,7 +928,6 @@ patron.display.prototype = {
                 if (obj.stop_checkouts && obj.checkout_window) {
                     setTimeout( function() {
                         try {
-                            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                             obj.checkout_window.g.checkout.check_disable();
                         } catch(E) { }
                     }, 1000);
diff --git a/Open-ILS/xul/staff_client/server/patron/display.xul b/Open-ILS/xul/staff_client/server/patron/display.xul
index 0d3c8d6..e0861db 100644
--- a/Open-ILS/xul/staff_client/server/patron/display.xul
+++ b/Open-ILS/xul/staff_client/server/patron/display.xul
@@ -38,7 +38,6 @@
     
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -67,7 +66,6 @@
             setTimeout(
                 function() {
                     try {
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         var node = g.patron.right_deck.node.selectedPanel;
                         if (node && get_contentWindow(node) && typeof get_contentWindow(node).default_focus == 'function') {
                             get_contentWindow(node).default_focus();
diff --git a/Open-ILS/xul/staff_client/server/patron/display_horiz.xul b/Open-ILS/xul/staff_client/server/patron/display_horiz.xul
index bf8f3b0..1c53834 100644
--- a/Open-ILS/xul/staff_client/server/patron/display_horiz.xul
+++ b/Open-ILS/xul/staff_client/server/patron/display_horiz.xul
@@ -38,7 +38,6 @@
     
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -67,7 +66,6 @@
             setTimeout(
                 function() {
                     try {
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         var node = g.patron.right_deck.node.selectedPanel;
                         if (node && get_contentWindow(node) && typeof get_contentWindow(node).default_focus == 'function') {
                             get_contentWindow(node).default_focus();
diff --git a/Open-ILS/xul/staff_client/server/patron/hold_details.js b/Open-ILS/xul/staff_client/server/patron/hold_details.js
index f35187d..be34911 100644
--- a/Open-ILS/xul/staff_client/server/patron/hold_details.js
+++ b/Open-ILS/xul/staff_client/server/patron/hold_details.js
@@ -2,7 +2,6 @@ function $(id) { return document.getElementById(id); }
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
@@ -233,7 +232,6 @@ function render_notes() {
 
 function new_notification() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalBrowserWrite");
         var xml = '<groupbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1">';
         xml += '<caption label="' + $("patronStrings").getString('staff.patron.hold_notices.new_notification_record') + '"/><grid flex="1"><columns><column/><column flex="1"/></columns><rows>';
         xml += '<row><label value="' + $("patronStrings").getString('staff.patron.hold_notices.method') + '"/><textbox id="method" name="fancy_data" context="clipboard"/></row>';
@@ -265,7 +263,6 @@ function new_notification() {
 
 function new_note() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalBrowserWrite");
         var xml = '<groupbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1">';
         xml += '<caption label="' + $("patronStrings").getString('staff.patron.hold_notes.new_note') + '"/><grid flex="1"><columns><column/><column flex="1"/></columns><rows>';
         xml += '<row><label value="' + $('patronStrings').getString('staff.patron.hold_notes.new_note.public') + '"/><checkbox id="pub" name="fancy_data" checked="false"/></row>';
diff --git a/Open-ILS/xul/staff_client/server/patron/holds.js b/Open-ILS/xul/staff_client/server/patron/holds.js
index a17e247..34210ce 100644
--- a/Open-ILS/xul/staff_client/server/patron/holds.js
+++ b/Open-ILS/xul/staff_client/server/patron/holds.js
@@ -254,7 +254,6 @@ patron.holds.prototype = {
                                     n.setAttribute('toggle','1');
                                     n.setAttribute('label', document.getElementById("circStrings").getString('staff.circ.holds.list_view.label'));
                                     n.setAttribute('accesskey', document.getElementById("circStrings").getString('staff.circ.holds.list_view.accesskey'));
-                                    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                                     if (obj.retrieve_ids.length == 0) return;
                                     var f = obj.browser.get_content();
                                     xulG.ahr_id = obj.retrieve_ids[0].id;
@@ -378,7 +377,7 @@ patron.holds.prototype = {
                                 });
 
                                 var loc = urls.XUL_BROWSER + "?url=" + window.escape(
-                                    xulG.url_prefix("/opac/extras/circ/alt_holds_print.html").replace("http:","https:")
+                                    xulG.url_prefix("ALT_HOLDS_PRINT")
                                 );
                                 xulG.new_tab(
                                     loc, {
@@ -498,7 +497,6 @@ patron.holds.prototype = {
                                 bot_xml += 'accesskey="'+ $("patronStrings").getString('staff.patron.holds.holds_edit_selection_depth.done.accesskey') +'" name="fancy_submit"/>';
                                 bot_xml += '<button label="'+ $("patronStrings").getString('staff.patron.holds.holds_edit_selection_depth.cancel.label') +'"';
                                 bot_xml += 'accesskey="'+ $("patronStrings").getString('staff.patron.holds.holds_edit_selection_depth.cancel.accesskey') +'" name="fancy_cancel"/></hbox>';
-                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                 //obj.data.temp_mid = xml; obj.data.stash('temp_mid');
                                 //obj.data.temp_bot = bot_xml; obj.data.stash('temp_bot');
                                 JSAN.use('util.window'); var win = new util.window();
@@ -567,7 +565,6 @@ patron.holds.prototype = {
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_edit_pickup_lib.done.accesskey')+'" name="fancy_submit"/>';
                                 bot_xml += '<button label="'+$("patronStrings").getString('staff.patron.holds.holds_edit_pickup_lib.cancel.label')+'"';
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_edit_pickup_lib.cancel.accesskey')+'" name="fancy_cancel"/></hbox>';
-                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                 //obj.data.temp_mid = xml; obj.data.stash('temp_mid');
                                 //obj.data.temp_bot = bot_xml; obj.data.stash('temp_bot');
                                 JSAN.use('util.window'); var win = new util.window();
@@ -617,7 +614,6 @@ patron.holds.prototype = {
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_edit_phone_notify.btn_done.accesskey')+'" name="fancy_submit"/>';
                                 bot_xml += '<button label="'+$("patronStrings").getString('staff.patron.holds.holds_edit_phone_notify.btn_cancel.label')+'"';
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_edit_phone_notify.btn_cancel.accesskey')+'" name="fancy_cancel"/></hbox>';
-                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                 //obj.data.temp_mid = xml; obj.data.stash('temp_mid');
                                 //obj.data.temp_bot = bot_xml; obj.data.stash('temp_bot');
                                 JSAN.use('util.window'); var win = new util.window();
@@ -669,7 +665,6 @@ patron.holds.prototype = {
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_edit_sms_notify.btn_done.accesskey')+'" name="fancy_submit"/>';
                                 bot_xml += '<button label="'+$("patronStrings").getString('staff.patron.holds.holds_edit_sms_notify.btn_cancel.label')+'"';
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_edit_sms_notify.btn_cancel.accesskey')+'" name="fancy_cancel"/></hbox>';
-                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                 //obj.data.temp_mid = xml; obj.data.stash('temp_mid');
                                 //obj.data.temp_bot = bot_xml; obj.data.stash('temp_bot');
                                 JSAN.use('util.window'); var win = new util.window();
@@ -743,7 +738,6 @@ patron.holds.prototype = {
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_edit_sms_carrier.btn_done.accesskey')+'" name="fancy_submit"/>';
                                 bot_xml += '<button label="'+$("patronStrings").getString('staff.patron.holds.holds_edit_sms_carrier.btn_cancel.label')+'"';
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_edit_sms_carrier.btn_cancel.accesskey')+'" name="fancy_cancel"/></hbox>';
-                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                 //obj.data.temp_mid = xml; obj.data.stash('temp_mid');
                                 //obj.data.temp_bot = bot_xml; obj.data.stash('temp_bot');
                                 JSAN.use('util.window'); var win = new util.window();
@@ -796,7 +790,6 @@ patron.holds.prototype = {
                                 var bot_xml = '<hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1" style="overflow: vertical">';
                                 bot_xml += '<spacer flex="1"/><button label="'+$("patronStrings").getString('staff.patron.holds.holds_edit_email_notify.btn_cancel.label')+'"';
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_edit_email_notify.btn_cancel.accesskey')+'" name="fancy_cancel"/></hbox>';
-                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                 //obj.data.temp_mid = xml; obj.data.stash('temp_mid');
                                 //obj.data.temp_bot = bot_xml; obj.data.stash('temp_bot');
                                 JSAN.use('util.window'); var win = new util.window();
@@ -856,7 +849,6 @@ patron.holds.prototype = {
                                 var bot_xml = '<hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1" style="overflow: vertical">';
                                 bot_xml += '<spacer flex="1"/><button label="'+$("patronStrings").getString('staff.patron.holds.holds_cut_in_line.btn_cancel.label')+'"';
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_cut_in_line.btn_cancel.accesskey')+'" name="fancy_cancel"/></hbox>';
-                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                 JSAN.use('util.window'); var win = new util.window();
                                 var fancy_prompt_data = win.open(
                                     urls.XUL_FANCY_PROMPT,
@@ -911,7 +903,6 @@ patron.holds.prototype = {
                                 var bot_xml = '<hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1" style="overflow: vertical">';
                                 bot_xml += '<spacer flex="1"/><button label="'+$("patronStrings").getString('staff.patron.holds.holds_desire_mint_condition.btn_cancel.label')+'"';
                                 bot_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.holds.holds_desire_mint_condition.btn_cancel.accesskey')+'" name="fancy_cancel"/></hbox>';
-                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                 JSAN.use('util.window'); var win = new util.window();
                                 var fancy_prompt_data = win.open(
                                     urls.XUL_FANCY_PROMPT,
@@ -1229,7 +1220,6 @@ patron.holds.prototype = {
                                     msg = $("patronStrings").getFormattedString('staff.patron.holds.holds_cancel.cancel_hold_message.singular', [hold_list.join(', ')]);
                                 }
 
-                                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                 JSAN.use('util.window');
                                 var win = new util.window();
                                 var my_xulG = win.open(
@@ -1337,22 +1327,22 @@ patron.holds.prototype = {
                                     var opac_url;
                                     switch(htype) {
                                         case 'M' :
-                                            opac_url = xulG.url_prefix( urls.opac_rresult_metarecord ) + htarget;
+                                            opac_url = xulG.url_prefix('opac_rresult_metarecord') + htarget;
                                         break;
                                         case 'T' :
-                                            opac_url = xulG.url_prefix( urls.opac_rdetail ) + htarget;
+                                            opac_url = xulG.url_prefix('opac_rdetail') + htarget;
                                         break;
                                         case 'P' :
-                                            opac_url = xulG.url_prefix( urls.opac_rdetail )
+                                            opac_url = xulG.url_prefix('opac_rdetail')
                                             + obj.hold_part_map[ obj.retrieve_ids[i].id ].record();
                                         break;
                                         case 'I' :
-                                            opac_url = xulG.url_prefix( urls.opac_rdetail )
+                                            opac_url = xulG.url_prefix('opac_rdetail')
                                             + obj.hold_subscription_map[ obj.retrieve_ids[i].id ].record_entry();
                                         break;
                                         case 'V' :
                                             var my_acn = obj.network.simple_request( 'FM_ACN_RETRIEVE.authoritative', [ htarget ]);
-                                            opac_url = xulG.url_prefix( urls.opac_rdetail) + my_acn.record();
+                                            opac_url = xulG.url_prefix('opac_rdetail') + my_acn.record();
                                         break;
                                         case 'C' :
                                         case 'R' :
@@ -1365,7 +1355,7 @@ patron.holds.prototype = {
                                                 my_acn = obj.network.simple_request( 'FM_ACN_RETRIEVE.authoritative',
                                                     [ my_acp.call_number() ]);
                                             }
-                                            opac_url = xulG.url_prefix( urls.opac_rdetail) + my_acn.record();
+                                            opac_url = xulG.url_prefix('opac_rdetail') + my_acn.record();
                                         break;
                                         default:
                                             obj.error.standard_unexpected_error_alert($("patronStrings").getFormattedString('staff.patron.holds.show_catalog.unknown_htype', [htype]), obj.retrieve_ids[i]);
@@ -1378,7 +1368,7 @@ patron.holds.prototype = {
                                         'opac_url' : opac_url
                                     };
                                     xulG.new_tab(
-                                        xulG.url_prefix(urls.XUL_OPAC_WRAPPER),
+                                        xulG.url_prefix('XUL_OPAC_WRAPPER'),
                                         {'tab_name': htype == 'M' ? 'Catalog' : $("patronStrings").getString('staff.patron.holds.show_catalog.retrieving_title') },
                                         content_params
                                     );
@@ -1467,14 +1457,13 @@ patron.holds.prototype = {
                         function(ev) {
                             try {
                                 var content_params = {
-                                    'show_nav_buttons' : false,
+                                    'show_nav_buttons' : true,
                                     'show_print_button' : true,
                                     'passthru_content_params' : {
                                         'authtoken' : ses(),
                                         'authtime' : ses('authtime'),
                                         'window_open' : function(a,b,c) {
                                             try {
-                                                netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
                                                 return window.open(a,b,c);
                                             } catch(E) {
                                                 obj.error.standard_unexpected_error_alert('window_open',E);
@@ -1528,7 +1517,7 @@ patron.holds.prototype = {
                                         'patron_barcode' : obj.patron_barcode
                                     },
                                     'url_prefix' : xulG.url_prefix,
-                                    'url' : xulG.url_prefix(urls.browser)
+                                    'url' : xulG.url_prefix('browser')
                                 };
                                 xulG.display_window.g.patron.right_deck.set_iframe( urls.XUL_REMOTE_BROWSER + '?patron_hold=1', {}, content_params);
                             } catch(E) {
@@ -1629,7 +1618,6 @@ patron.holds.prototype = {
             }
             dump('hold details UI ready\n');
         }
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
         JSAN.use('util.browser');
         obj.browser = new util.browser();
         obj.browser.init(
diff --git a/Open-ILS/xul/staff_client/server/patron/holds.xul b/Open-ILS/xul/staff_client/server/patron/holds.xul
index 7954004..f7f03fc 100644
--- a/Open-ILS/xul/staff_client/server/patron/holds.xul
+++ b/Open-ILS/xul/staff_client/server/patron/holds.xul
@@ -37,7 +37,6 @@
         
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/patron/holds_overlay.xul b/Open-ILS/xul/staff_client/server/patron/holds_overlay.xul
index 2326cdf..8b73396 100644
--- a/Open-ILS/xul/staff_client/server/patron/holds_overlay.xul
+++ b/Open-ILS/xul/staff_client/server/patron/holds_overlay.xul
@@ -62,7 +62,7 @@
     </commandset>
 
     <popupset id="holds_popupset">
-        <popup id="holds_actions" position="at_pointer"> 
+        <menupopup id="holds_actions" position="at_pointer"> 
             <menuitem command="sel_clip" label="&staff.circ.holds.copy_to_clipboard;" accesskey="&staff.circ.holds.copy_to_clipboard.accesskey;" />
             <menuitem label="&staff.circ.holds.show_in_catalog;" command="cmd_show_catalog" accesskey="&staff.circ.holds.show_in_catalog.accesskey;"/>
             <menuitem command="sel_copy_details" label="&staff.circ.holds.show_item_details;" accesskey="&staff.circ.holds.show_item_details.accesskey;" />
@@ -94,7 +94,7 @@
             <menuitem id="holds_uncancel_btn" hidden="true" label="&staff.circ.holds.uncancel;" command="cmd_holds_uncancel" accesskey="&staff.circ.holds.uncancel.accesskey;"/>
             <menuseparator />
             <menuitem command="save_columns" label="&staff.circ.holds.save_columns;" accesskey="&staff.circ.holds.save_columns.accesskey;"/>
-        </popup>
+        </menupopup>
     </popupset>
 
 
@@ -110,7 +110,7 @@
             </vbox>
             <deck id="deck" flex="1">
                 <tree id="holds_list" flex="1" enableColumnDrag="true" context="holds_actions"/>
-                <browser id="hold_detail_frame" src="" flex="1" autoscroll="false" />
+                <browser id="hold_detail_frame" src="" flex="1" autoscroll="false" oils_force_external="true" />
             </deck>
             <vbox flex="0">
             <hbox id="holds_bottom_ui" />
diff --git a/Open-ILS/xul/staff_client/server/patron/info_group.js b/Open-ILS/xul/staff_client/server/patron/info_group.js
index 0dcb98f..60f754f 100644
--- a/Open-ILS/xul/staff_client/server/patron/info_group.js
+++ b/Open-ILS/xul/staff_client/server/patron/info_group.js
@@ -2,7 +2,6 @@ function $(id) { return document.getElementById(id); }
 
 function my_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
         JSAN.errorLevel = "die"; // none, warn, or die
         JSAN.addRepository('/xul/server/');
@@ -312,7 +311,7 @@ function clone_patron() {
     if (! g.sel_list ) return;
     try {
         for (var i = 0; i < g.sel_list.length; i++) {    
-            var loc = xulG.url_prefix( urls.XUL_REMOTE_BROWSER ); 
+            var loc = xulG.url_prefix('XUL_REMOTE_BROWSER'); 
                 //+ '?url=' + window.escape( urls.XUL_PATRON_EDIT + '?ses=' 
                 //+ window.escape( ses() ) + '&clone=' + g.sel_list[i] );
             if (typeof window.xulG == 'object' && typeof window.xulG.new_tab == 'function') xulG.new_tab(
@@ -355,7 +354,7 @@ function spawn_editor(p) {
     for (var i in p) {
         passthru[i] = p[i];
     }
-    var loc = xulG.url_prefix( urls.XUL_REMOTE_BROWSER ); // + '?url=' + window.escape( url );
+    var loc = xulG.url_prefix('XUL_REMOTE_BROWSER'); // + '?url=' + window.escape( url );
     if (typeof window.xulG == 'object' && typeof window.xulG.new_tab == 'function') xulG.new_tab(
         loc, 
         {}, 
@@ -444,7 +443,6 @@ function link_patron(direction) {
             }
 
             var horizontal_interface = String( g.data.hash.aous['ui.circ.patron_summary.horizontal'] ) == 'true';
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
             var top_xml = '<vbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1" style="overflow: auto"><description>' + second_msg + '</description>';
             top_xml += '<hbox><spacer flex="1"/><button label="'+$("patronStrings").getString('staff.patron.info_group.link_patron.move.label')+'"';
             top_xml += ' accesskey="'+$("patronStrings").getString('staff.patron.info_group.link_patron.move.accesskey')+'" name="fancy_submit"/>';
@@ -465,8 +463,8 @@ function link_patron(direction) {
                 xml += '<image src="/xul/server/skin/media/images/patron_left_arrow.png"/>';
             }
             xml += '</hbox>';
-            xml += '<iframe style="min-height: 100px" flex="1" src="' + xulG.url_prefix( urls.XUL_PATRON_SUMMARY );
-            xml += '?show_name=1&amp;id=' + g.sel_list[i] + '"/>';
+            xml += '<iframe style="min-height: 100px" flex="1" src="' + xulG.url_prefix('XUL_PATRON_SUMMARY');
+            xml += '?show_name=1&amp;id=' + g.sel_list[i] + '" oils_force_external="true"/>';
             xml += '</vbox>';
             xml += '<vbox flex="1">';
             xml += '<hbox>';
@@ -476,8 +474,8 @@ function link_patron(direction) {
                 xml += '<image src="/xul/server/skin/media/images/patron_left_arrow.png"/>';
             }
             xml += '<spacer flex="1"/></hbox>';
-            xml += '<iframe style="min-height: 100px" flex="1" src="' + xulG.url_prefix( urls.XUL_PATRON_SUMMARY );
-            xml += '?show_name=1&amp;id=' + patron_b.id() + '"/>';
+            xml += '<iframe style="min-height: 100px" flex="1" src="' + xulG.url_prefix('XUL_PATRON_SUMMARY');
+            xml += '?show_name=1&amp;id=' + patron_b.id() + '" oils_force_external="true"/>';
             xml += '</vbox>';
             /************/
             if (horizontal_interface) {
diff --git a/Open-ILS/xul/staff_client/server/patron/info_group.xul b/Open-ILS/xul/staff_client/server/patron/info_group.xul
index 1d4211d..9e8777e 100644
--- a/Open-ILS/xul/staff_client/server/patron/info_group.xul
+++ b/Open-ILS/xul/staff_client/server/patron/info_group.xul
@@ -60,14 +60,14 @@
     </commandset>
 
     <popupset id="info_group_popupset">
-        <popup id="info_group_actions" position="at_pointer"> 
+        <menupopup id="info_group_actions" position="at_pointer"> 
             <menuitem command="clone" />
             <menuitem command="remove" />
             <menuitem command="move" />
             <menuitem command="add" />
             <menuitem command="retrieve_p" />
             <menuitem command="merge_p" />
-        </popup>
+        </menupopup>
     </popupset>
 
     <vbox flex="1" class="my_overflow" id="group_panel">
diff --git a/Open-ILS/xul/staff_client/server/patron/info_notes.xul b/Open-ILS/xul/staff_client/server/patron/info_notes.xul
index d10e821..133eec5 100644
--- a/Open-ILS/xul/staff_client/server/patron/info_notes.xul
+++ b/Open-ILS/xul/staff_client/server/patron/info_notes.xul
@@ -39,7 +39,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -186,7 +185,6 @@
         
         function new_note() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalBrowserWrite");
                 var xml = '<groupbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1">';
                 xml += '<caption label="'+$("patronStrings").getString('staff.patron.info_notes.new_note.label')+'"/><grid flex="1"><columns><column/><column flex="1"/></columns><rows><row>';
                 xml += '<label value="'+$("patronStrings").getString('staff.patron.info_notes.new_note.patron_visible.value')+'"/><checkbox id="pub" name="fancy_data"/></row>';
diff --git a/Open-ILS/xul/staff_client/server/patron/info_stat_cats.xul b/Open-ILS/xul/staff_client/server/patron/info_stat_cats.xul
index 9dab916..4318313 100644
--- a/Open-ILS/xul/staff_client/server/patron/info_stat_cats.xul
+++ b/Open-ILS/xul/staff_client/server/patron/info_stat_cats.xul
@@ -35,7 +35,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/patron/info_surveys.xul b/Open-ILS/xul/staff_client/server/patron/info_surveys.xul
index 2af2ed0..66231c3 100644
--- a/Open-ILS/xul/staff_client/server/patron/info_surveys.xul
+++ b/Open-ILS/xul/staff_client/server/patron/info_surveys.xul
@@ -35,7 +35,6 @@
 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/patron/items.js b/Open-ILS/xul/staff_client/server/patron/items.js
index ac0f2df..47fa5e7 100644
--- a/Open-ILS/xul/staff_client/server/patron/items.js
+++ b/Open-ILS/xul/staff_client/server/patron/items.js
@@ -650,14 +650,14 @@ patron.items.prototype = {
                     alert($("patronStrings").getFormattedString('staff.patron.items.show_catalog.barcode_not_cataloged', [retrieve_ids[i].barcode]));
                     continue;
                 }
-                var opac_url = xulG.url_prefix( urls.opac_rdetail ) + doc_id;
+                var opac_url = xulG.url_prefix('opac_rdetail') + doc_id;
                 var content_params = { 
                     'session' : ses(),
                     'authtime' : ses('authtime'),
                     'opac_url' : opac_url
                 };
                 xulG.new_tab(
-                    xulG.url_prefix(urls.XUL_OPAC_WRAPPER), 
+                    xulG.url_prefix('XUL_OPAC_WRAPPER'), 
                     {'tab_name': $("patronStrings").getString('staff.patron.items.show_catalog.retrieving_title')}, 
                     content_params
                 );
diff --git a/Open-ILS/xul/staff_client/server/patron/items.xul b/Open-ILS/xul/staff_client/server/patron/items.xul
index ddc7c5f..6faf415 100644
--- a/Open-ILS/xul/staff_client/server/patron/items.xul
+++ b/Open-ILS/xul/staff_client/server/patron/items.xul
@@ -34,7 +34,6 @@
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/patron/items_overlay.xul b/Open-ILS/xul/staff_client/server/patron/items_overlay.xul
index e21e99d..baa00c7 100644
--- a/Open-ILS/xul/staff_client/server/patron/items_overlay.xul
+++ b/Open-ILS/xul/staff_client/server/patron/items_overlay.xul
@@ -57,7 +57,7 @@
 
 
 <popupset id="items_popupset">
-    <popup id="items_actions" position="at_pointer"> 
+    <menupopup id="items_actions" position="at_pointer"> 
         <menuitem command="sel_clip" label="&staff.patron.items_overlay.sel_clip.label;" accesskey="&staff.patron.items_overlay.sel_clip.accesskey;"/>
         <menuitem command="sel_bucket" label="&staff.patron.items_overlay.sel_bucket.label;" accesskey="&staff.patron.items_overlay.sel_bucket.accesskey;"/>
         <menuitem label="&staff.patron.items_overlay.show_catalog.label;" command="cmd_show_catalog" />
@@ -78,8 +78,8 @@
         <menuitem label="&staff.patron.items_overlay.add_billing.label;" command="cmd_add_billing" />
         <menuseparator />
         <menuitem command="save_columns" label="&staff.patron.items_overlay.save_columns.label;"/>
-    </popup>
-    <popup id="items_actions2" position="at_pointer"> 
+    </menupopup>
+    <menupopup id="items_actions2" position="at_pointer"> 
         <menuitem command="sel_clip2" label="&staff.patron.items_overlay.sel_clip.label;" accesskey="&staff.patron.items_overlay.sel_clip.accesskey;" />
         <menuitem command="sel_bucket2" label="&staff.patron.items_overlay.sel_bucket.label;" accesskey="&staff.patron.items_overlay.sel_bucket.accesskey;"/>
         <menuitem label="&staff.patron.items_overlay.show_catalog.label;" command="cmd_show_catalog2" />
@@ -99,7 +99,7 @@
         <menuitem label="&staff.patron.items_overlay.add_billing.label;" command="cmd_add_billing2" />
         <menuseparator />
         <menuitem command="save_columns2" label="&staff.patron.items_overlay.save_columns.label;"/>
-    </popup>
+    </menupopup>
 
 </popupset>
 
diff --git a/Open-ILS/xul/staff_client/server/patron/place_hold.js b/Open-ILS/xul/staff_client/server/patron/place_hold.js
index 5f6c103..4dd8423 100644
--- a/Open-ILS/xul/staff_client/server/patron/place_hold.js
+++ b/Open-ILS/xul/staff_client/server/patron/place_hold.js
@@ -300,8 +300,6 @@ function populate_pickup_lib_menu() {
 }
 
 function ui_setup() {
-    netscape.security.PrivilegeManager.enablePrivilege(
-        "UniversalXPConnect");
     if (typeof JSAN == 'undefined') {
         throw( "The JSAN library object is missing.");
     }
diff --git a/Open-ILS/xul/staff_client/server/patron/search_form.xul b/Open-ILS/xul/staff_client/server/patron/search_form.xul
index 6ebb6e1..43a4fde 100644
--- a/Open-ILS/xul/staff_client/server/patron/search_form.xul
+++ b/Open-ILS/xul/staff_client/server/patron/search_form.xul
@@ -35,7 +35,6 @@
         
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -73,7 +72,6 @@
             setTimeout(
                 function() {
                     try {
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         document.getElementById('family_name').focus();
                     } catch(E) {
                         g.error.sdump('D_ERROR','default_focus(): ' + js2JSON(E));
diff --git a/Open-ILS/xul/staff_client/server/patron/search_form_horiz.xul b/Open-ILS/xul/staff_client/server/patron/search_form_horiz.xul
index 1ad8553..4e8f6af 100644
--- a/Open-ILS/xul/staff_client/server/patron/search_form_horiz.xul
+++ b/Open-ILS/xul/staff_client/server/patron/search_form_horiz.xul
@@ -35,7 +35,6 @@
         
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -73,7 +72,6 @@
             setTimeout(
                 function() {
                     try {
-                        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                         document.getElementById('family_name').focus();
                     } catch(E) {
                         g.error.sdump('D_ERROR','default_focus(): ' + js2JSON(E));
diff --git a/Open-ILS/xul/staff_client/server/patron/search_result.xul b/Open-ILS/xul/staff_client/server/patron/search_result.xul
index bb31f06..9546380 100644
--- a/Open-ILS/xul/staff_client/server/patron/search_result.xul
+++ b/Open-ILS/xul/staff_client/server/patron/search_result.xul
@@ -35,7 +35,6 @@
         
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/patron/staged.js b/Open-ILS/xul/staff_client/server/patron/staged.js
index a5a9d3e..45e1567 100644
--- a/Open-ILS/xul/staff_client/server/patron/staged.js
+++ b/Open-ILS/xul/staff_client/server/patron/staged.js
@@ -9,8 +9,6 @@ function refresh() { populate_list(); }
 
 function staged_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); 
-
         commonStrings = $('commonStrings');
         patronStrings = $('patronStrings');
 
@@ -145,7 +143,7 @@ function spawn_search(s) {
 
 function spawn_editor(p,func) {
     var url = urls.XUL_PATRON_EDIT;
-    var loc = xulG.url_prefix( urls.XUL_REMOTE_BROWSER );
+    var loc = xulG.url_prefix('XUL_REMOTE_BROWSER');
     xulG.new_tab(
         loc, 
         {}, 
diff --git a/Open-ILS/xul/staff_client/server/patron/staged.xul b/Open-ILS/xul/staff_client/server/patron/staged.xul
index 859324f..f7fb70f 100644
--- a/Open-ILS/xul/staff_client/server/patron/staged.xul
+++ b/Open-ILS/xul/staff_client/server/patron/staged.xul
@@ -62,10 +62,10 @@
     </groupbox>
 
     <popupset id="stgu_popupset">
-        <popup id="stgu_actions" position="at_pointer">
+        <menupopup id="stgu_actions" position="at_pointer">
             <menuitem command="cmd_load" label="&staff.patron_display.staged.menu.actions.load.label;" accesskey="&staff.patron_display.menu.actions.load.accesskey;"/>
             <menuitem command="cmd_cancel" label="&staff.patron_display.staged.menu.actions.cancel.label;" accesskey="&staff.patron_display.menu.actions.cancel.accesskey;"/>
-        </popup>
+        </menupopup>
     </popupset>
 
 </window>
diff --git a/Open-ILS/xul/staff_client/server/patron/standing_penalties.js b/Open-ILS/xul/staff_client/server/patron/standing_penalties.js
index 4f7a629..ce62e22 100644
--- a/Open-ILS/xul/staff_client/server/patron/standing_penalties.js
+++ b/Open-ILS/xul/staff_client/server/patron/standing_penalties.js
@@ -4,8 +4,6 @@ function default_focus() { document.getElementById('apply_btn').focus(); } // pa
 
 function penalty_init() {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); 
-
         commonStrings = document.getElementById('commonStrings');
         patronStrings = document.getElementById('patronStrings');
 
@@ -132,7 +130,6 @@ function populate_list() {
 
 function handle_apply_penalty(ev) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); 
         JSAN.use('util.window');
         var win = new util.window();
         var my_xulG = win.open(
@@ -269,7 +266,6 @@ function generate_penalty_remove_function(id) {
 function handle_edit_penalty(ev) {
     try {
 
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); 
         JSAN.use('util.window');
         var win = new util.window();
 
diff --git a/Open-ILS/xul/staff_client/server/patron/standing_penalties.xul b/Open-ILS/xul/staff_client/server/patron/standing_penalties.xul
index 50307d4..a1b5d90 100644
--- a/Open-ILS/xul/staff_client/server/patron/standing_penalties.xul
+++ b/Open-ILS/xul/staff_client/server/patron/standing_penalties.xul
@@ -112,11 +112,11 @@
     </groupbox>
 
     <popupset id="csp_popupset">
-        <popup id="ausp_actions" position="at_pointer">
+        <menupopup id="ausp_actions" position="at_pointer">
             <menuitem command="cmd_remove_penalty" label="&staff.patron_display.penalty.menu.actions.remove.label;" accesskey="&staff.patron_display.menu.actions.remove.accesskey;"/>
             <menuitem command="cmd_edit_penalty" label="&staff.patron_display.penalty.menu.actions.edit.label;" accesskey="&staff.patron_display.menu.actions.edit.accesskey;"/>
             <menuitem command="cmd_archive_penalty" label="&staff.patron_display.penalty.menu.actions.archive.label;" accesskey="&staff.patron_display.menu.actions.archive.accesskey;"/>
-        </popup>
+        </menupopup>
     </popupset>
 
 </window>
diff --git a/Open-ILS/xul/staff_client/server/patron/summary.js b/Open-ILS/xul/staff_client/server/patron/summary.js
index 7e1272f..0b65cc4 100644
--- a/Open-ILS/xul/staff_client/server/patron/summary.js
+++ b/Open-ILS/xul/staff_client/server/patron/summary.js
@@ -908,7 +908,6 @@ patron.summary.prototype = {
                         function() {
                             //alert('setting shrink_state to ' + gb_content.hidden);
                             //caption.setAttribute('shrink_state',gb_content.hidden);
-                            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                             JSAN.use('util.file'); var file = new util.file('patron_id_shrink');
                             file.set_object(String(gb_content.hidden)); file.close();
                         }, 0
@@ -917,7 +916,6 @@ patron.summary.prototype = {
             );
             //var shrink_state = caption.getAttribute('shrink_state');
             var shrink_state = false;
-            netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
             JSAN.use('util.file'); var file = new util.file('patron_id_shrink');
             if (file._file.exists()) {
                 shrink_state = file.get_object(); file.close();
diff --git a/Open-ILS/xul/staff_client/server/patron/summary.xul b/Open-ILS/xul/staff_client/server/patron/summary.xul
index c84352a..cee959b 100644
--- a/Open-ILS/xul/staff_client/server/patron/summary.xul
+++ b/Open-ILS/xul/staff_client/server/patron/summary.xul
@@ -37,12 +37,10 @@
         function myObserver() { this.register(); }
         myObserver.prototype = {
             register: function() {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 var observerService = Components.classes["@mozilla.org/observer-service;1"].getService(Components.interfaces.nsIObserverService);
                 observerService.addObserver(this, "xul-overlay-merged", false);
             },
             unregister: function() {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 var observerService = Components.classes["@mozilla.org/observer-service;1"].getService(Components.interfaces.nsIObserverService);
                 observerService.removeObserver(this, "xul-overlay-merged");
             },
@@ -55,7 +53,6 @@
                 
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
                 JSAN.errorLevel = "die"; // none, warn, or die
                 JSAN.addRepository('/xul/server/');
@@ -117,8 +114,6 @@
     
         function post_overlay() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
                 var patron_id = xul_param('id'); 
                 var patron_bc = xul_param('barcode'); 
 
diff --git a/Open-ILS/xul/staff_client/server/patron/summary_overlay.xul b/Open-ILS/xul/staff_client/server/patron/summary_overlay.xul
index ae9ff7a..4a39089 100644
--- a/Open-ILS/xul/staff_client/server/patron/summary_overlay.xul
+++ b/Open-ILS/xul/staff_client/server/patron/summary_overlay.xul
@@ -208,10 +208,10 @@
 </grid>
 
 <popupset id="patron_summary_popups">
-    <popup id="addr_export_popup" oncommand="export_address(event);">
+    <menupopup id="addr_export_popup" oncommand="export_address(event);">
         <menuitem id="addr_export_copy" label="&staff.patron_display.address_export_popup.copy;"/>
         <menuitem id="addr_export_print" label="&staff.patron_display.address_export_popup.print;"/>
-    </popup>
+    </menupopup>
 </popupset>
 
 <groupbox id="PatronSummaryContact_mailing_address" orient="vertical">
diff --git a/Open-ILS/xul/staff_client/server/patron/summary_overlay_horiz.xul b/Open-ILS/xul/staff_client/server/patron/summary_overlay_horiz.xul
index ac495ac..037adf6 100644
--- a/Open-ILS/xul/staff_client/server/patron/summary_overlay_horiz.xul
+++ b/Open-ILS/xul/staff_client/server/patron/summary_overlay_horiz.xul
@@ -13,11 +13,11 @@
 </commandset>
 
 <popupset id="patron_summary_popups">
-    <popup id="group_actions" position="at_pointer">
+    <menupopup id="group_actions" position="at_pointer">
         <menuitem command="group_tab_retrieve_patron"
             label="&staff.patron.summary_overlay.group_tab.retrieve_patron.label;"
             accesskey="&staff.patron.summary_overlay.group_tab.retrieve_patron.accesskey;" />
-    </popup>
+    </menupopup>
 </popupset>
 
 <box id="patron_summary_main" flex="1" orient="vertical" class="my_overflow">
@@ -254,10 +254,10 @@
 </vbox>
 
 <popupset id="patron_summary_popups">
-    <popup id="addr_export_popup" oncommand="export_address(event);">
+    <menupopup id="addr_export_popup" oncommand="export_address(event);">
         <menuitem id="addr_export_copy" label="&staff.patron_display.address_export_popup.copy;"/>
         <menuitem id="addr_export_print" label="&staff.patron_display.address_export_popup.print;"/>
-    </popup>
+    </menupopup>
 </popupset>
 
 <vbox id="PatronSummaryContact_address">
diff --git a/Open-ILS/xul/staff_client/server/patron/user_buckets.xul b/Open-ILS/xul/staff_client/server/patron/user_buckets.xul
index d343a64..18eb8b6 100644
--- a/Open-ILS/xul/staff_client/server/patron/user_buckets.xul
+++ b/Open-ILS/xul/staff_client/server/patron/user_buckets.xul
@@ -37,8 +37,6 @@
         
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
                 /* load translatable strings for patron interfaces */
                 patronStrings = document.getElementById('patronStrings');
 
diff --git a/Open-ILS/xul/staff_client/server/patron/util.js b/Open-ILS/xul/staff_client/server/patron/util.js
index 427460c..02e074e 100644
--- a/Open-ILS/xul/staff_client/server/patron/util.js
+++ b/Open-ILS/xul/staff_client/server/patron/util.js
@@ -847,7 +847,6 @@ patron.util.set_penalty_css = function(patron) {
 patron.util.merge = function(record_ids) {
     var error;
     try {
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
         JSAN.use('util.error'); error = new util.error();
         JSAN.use('OpenILS.data'); var data = new OpenILS.data(); data.stash_retrieve();
         var horizontal_interface = String( data.hash.aous['ui.circ.patron_summary.horizontal'] ) == 'true';
@@ -888,7 +887,7 @@ patron.util.merge = function(record_ids) {
                 xml += '<tr valign="top">' + table_cell_with_lead_button( record_ids[i] );
             }
             xml += '<td nowrap="nowrap"><iframe style="' + iframe_css + '" flex="1" src="' + urls.XUL_PATRON_SUMMARY; 
-            xml += '?id=' + record_ids[i] + '&amp;show_name=1"/></td>';
+            xml += '?id=' + record_ids[i] + '&amp;show_name=1" oils_force_external="true"/></td>';
             if (horizontal_interface) {
                 xml += '</tr>';
             }
@@ -944,7 +943,6 @@ patron.util.format_name = function(patron_obj) {
 patron.util.work_log_patron_edit = function(p) {
     var error;
     try {
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
         JSAN.use('util.error'); error = new util.error();
         error.work_log(
             document.getElementById('patronStrings').getFormattedString(
diff --git a/Open-ILS/xul/staff_client/server/serial/batch_receive.js b/Open-ILS/xul/staff_client/server/serial/batch_receive.js
index 433843c..deee3c0 100644
--- a/Open-ILS/xul/staff_client/server/serial/batch_receive.js
+++ b/Open-ILS/xul/staff_client/server/serial/batch_receive.js
@@ -558,7 +558,7 @@ function BatchReceiver() {
                 "oncomplete": function(r) {
                     if ((r = openils.Util.readResponse(r)) && r.length) {
                         openils.XUL.newTabEasy(
-                            "/eg/serial/print_routing_list_users",
+                            "SERIAL_PRINT_ROUTING_LIST_USERS",
                             S("print_routing_list_users"), {
                                 "show_print_button": false, /* we supply one */
                                 "routing_list_data": {
@@ -1124,10 +1124,14 @@ function BatchReceiver() {
 
 function my_init() {
     var cgi = new openils.CGI();
-
+    var authtoken = (typeof ses == "function" ? ses() : 0) ||
+            cgi.param("ses") || dojo.cookie("ses");
+    if(!authtoken && openils.XUL.isXUL()) {
+        var stash = openils.XUL.getStash();
+        authtoken = stash.session.key;
+    }
     batch_receiver = new BatchReceiver(
-        (typeof ses == "function" ? ses() : 0) ||
-            cgi.param("ses") || dojo.cookie("ses"),
+        authtoken,
         cgi.param("docid") || null, cgi.param("subid") || null
     );
 }
diff --git a/Open-ILS/xul/staff_client/server/serial/editor_base.js b/Open-ILS/xul/staff_client/server/serial/editor_base.js
index 2d5ae08..91f84ae 100644
--- a/Open-ILS/xul/staff_client/server/serial/editor_base.js
+++ b/Open-ILS/xul/staff_client/server/serial/editor_base.js
@@ -11,7 +11,6 @@ serial.editor_base = {
             /******************************************************************************************************/
             /* setup JSAN and some initial libraries */
 
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             if (typeof JSAN == 'undefined') {
                 throw( $('commonStrings').getString('common.jsan.missing') );
             }
diff --git a/Open-ILS/xul/staff_client/server/serial/manage_dists.js b/Open-ILS/xul/staff_client/server/serial/manage_dists.js
index 14671c1..e5fece2 100644
--- a/Open-ILS/xul/staff_client/server/serial/manage_dists.js
+++ b/Open-ILS/xul/staff_client/server/serial/manage_dists.js
@@ -4,7 +4,6 @@ dump('entering serial/manage_dists.js\n');
 if (typeof serial == 'undefined') serial = {};
 serial.manage_dists = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
     } catch(E) {
         dump('serial/manage_dists: ' + E + '\n');
@@ -134,7 +133,6 @@ serial.manage_dists.prototype = {
     'init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var obj = this;
 
             obj.docid = params.docid;
@@ -276,8 +274,6 @@ serial.manage_dists.prototype = {
                                     
                                     var list = obj.ids_from_sel_list('sdist');
 
-                                    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
-
                                     JSAN.use('util.functional');
 
                                     var sdist_list = util.functional.map_list(
@@ -297,7 +293,7 @@ serial.manage_dists.prototype = {
                                         + '" accesskey="' 
                                         + document.getElementById('catStrings').getString('staff.cat.copy_browser.transfer.cancel.accesskey') 
                                         + '" name="fancy_cancel"/></hbox>';
-                                    xml += '<iframe style="overflow: scroll" flex="1" src="' + urls.XUL_BIB_BRIEF + '?docid=' + obj.data.marked_library.docid + '"/>';
+                                    xml += '<iframe style="overflow: scroll" flex="1" src="' + urls.XUL_BIB_BRIEF + '?docid=' + obj.data.marked_library.docid + '" oils_force_external="true"/>';
                                     xml += '</vbox>';
                                     JSAN.use('OpenILS.data');
                                     var data = new OpenILS.data(); data.init({'via':'stash'});
@@ -460,7 +456,7 @@ serial.manage_dists.prototype = {
                                     obj.data.temp_barcodes_for_labels = util.functional.map_list( list, function(o){return o.barcode();}) ; 
                                     obj.data.stash('temp_barcodes_for_labels');
                                     xulG.new_tab(
-                                        xulG.url_prefix( urls.XUL_SPINE_LABEL ),
+                                        xulG.url_prefix('XUL_SPINE_LABEL'),
                                         { 'tab_name' : document.getElementById('catStrings').getString('staff.cat.copy_browser.print_spine.tab') },
                                         {}
                                     );
@@ -1080,7 +1076,6 @@ serial.manage_dists.prototype = {
     'list_init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var obj = this;
             
             JSAN.use('circ.util');
@@ -1128,7 +1123,6 @@ serial.manage_dists.prototype = {
                         return row;
                     },
                     'on_click' : function(ev) {
-                        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserRead');
                         var row = {}; var col = {}; var nobj = {};
                         obj.list.node.treeBoxObject.getCellAt(ev.clientX,ev.clientY,row,col,nobj); 
                         if ((row.value == -1)||(nobj.value != 'twisty')) { return; } // on_click runs for twistys only
diff --git a/Open-ILS/xul/staff_client/server/serial/manage_dists.xul b/Open-ILS/xul/staff_client/server/serial/manage_dists.xul
index 3daf758..442ac47 100644
--- a/Open-ILS/xul/staff_client/server/serial/manage_dists.xul
+++ b/Open-ILS/xul/staff_client/server/serial/manage_dists.xul
@@ -26,7 +26,6 @@ vim:noet:sw=4:ts=4:
                                 return;
                             }
                             try {
-                                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                 if (typeof JSAN == 'undefined') { 
                                     throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                                 }
@@ -50,7 +49,7 @@ vim:noet:sw=4:ts=4:
                 </script>
 
                 <popupset>
-                    <popup id="serial_manage_dists_popup">
+                    <menupopup id="serial_manage_dists_popup">
                         <menuitem command="cmd_add_sstr" label="&staff.serial.manage_dists.actions.cmd_add_sstr.label;"/>
                         <menuseparator/>
                         <menuitem command="cmd_delete_sstr" label="&staff.serial.manage_dists.actions.cmd_delete_sstr.label;"/>
@@ -65,7 +64,7 @@ vim:noet:sw=4:ts=4:
                         <menuitem command="cmd_delete_siss" label="Delete Issuance"/>
                         <menuitem command="cmd_delete_scap" label="Delete Caption/Pattern"/>
                         -->
-                    </popup>
+                    </menupopup>
                 </popupset>
 
                 <hbox flex="1">
diff --git a/Open-ILS/xul/staff_client/server/serial/manage_items.js b/Open-ILS/xul/staff_client/server/serial/manage_items.js
index 67b65fd..9b519b4 100644
--- a/Open-ILS/xul/staff_client/server/serial/manage_items.js
+++ b/Open-ILS/xul/staff_client/server/serial/manage_items.js
@@ -653,7 +653,7 @@ serial.manage_items.prototype = {
 		try {
             JSAN.use('util.window'); var win = new util.window();
             var select_unit_window = win.open(
-                xulG.url_prefix(urls.XUL_SERIAL_SELECT_UNIT),
+                xulG.url_prefix('XUL_SERIAL_SELECT_UNIT'),
                 '_blank',
                 'chrome,resizable,modal,centerscreen',
                 {'sdist_ids' : obj.sdist_ids}
diff --git a/Open-ILS/xul/staff_client/server/serial/manage_items.xul b/Open-ILS/xul/staff_client/server/serial/manage_items.xul
index b8f8115..b9ddaea 100644
--- a/Open-ILS/xul/staff_client/server/serial/manage_items.xul
+++ b/Open-ILS/xul/staff_client/server/serial/manage_items.xul
@@ -15,7 +15,6 @@ vim:noet:sw=4:ts=4:
     <![CDATA[
         function my_init() {
             try {
-                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { 
                     throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                 }
@@ -39,14 +38,14 @@ vim:noet:sw=4:ts=4:
     ]]>
     </script>
     <popupset>
-        <popup id="serial_manage_items_popup">
+        <menupopup id="serial_manage_items_popup">
             <menuitem command="cmd_edit_items" label="&staff.serial.manage_items.actions.cmd_edit_items.label;" accesskey="&staff.serial.manage_items.actions.cmd_edit_items.accesskey;"/>
             <menuitem command="cmd_reset_items" label="&staff.serial.manage_items.actions.cmd_reset_items.label;" />
             <menuitem command="cmd_delete_items" label="&staff.serial.manage_items.actions.cmd_delete_items.label;" accesskey="&staff.serial.manage_items.actions.cmd_delete_items.accesskey;"/>
             <menuitem command="cmd_view_sitem_notes" label="&staff.serial.manage_items.actions.cmd_view_sitem_notes.label;" accesskey="&staff.serial.manage_items.actions.cmd_view_sitem_notes.accesskey;"/>
             <menuitem command="cmd_view_sdist_notes" label="&staff.serial.manage_items.actions.cmd_view_sdist_notes.label;" accesskey="&staff.serial.manage_items.actions.cmd_view_sdist_notes.accesskey;"/>
             <menuitem command="cmd_view_ssub_notes" label="&staff.serial.manage_items.actions.cmd_view_ssub_notes.label;" accesskey="&staff.serial.manage_items.actions.cmd_view_ssub_notes.accesskey;"/>
-        </popup>
+        </menupopup>
     </popupset>
     <tabpanel id="serial_manage_items" orient="vertical" flex="1">
         <hbox align="center">
diff --git a/Open-ILS/xul/staff_client/server/serial/manage_subs.js b/Open-ILS/xul/staff_client/server/serial/manage_subs.js
index 8982959..7607964 100644
--- a/Open-ILS/xul/staff_client/server/serial/manage_subs.js
+++ b/Open-ILS/xul/staff_client/server/serial/manage_subs.js
@@ -4,7 +4,6 @@ dump('entering serial/manage_subs.js\n');
 if (typeof serial == 'undefined') serial = {};
 serial.manage_subs = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
     } catch(E) {
         dump('serial/manage_subs: ' + E + '\n');
@@ -174,7 +173,6 @@ serial.manage_subs.prototype = {
     'init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var obj = this;
 
             obj.docid = params.docid;
@@ -534,8 +532,6 @@ serial.manage_subs.prototype = {
                                     
                                     var list = obj.ids_from_sel_list('ssub');
 
-                                    netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserWrite');
-
                                     JSAN.use('util.functional');
 
                                     var ssub_list = util.functional.map_list(
@@ -555,7 +551,7 @@ serial.manage_subs.prototype = {
                                         + '" accesskey="' 
                                         + document.getElementById('catStrings').getString('staff.cat.copy_browser.transfer.cancel.accesskey') 
                                         + '" name="fancy_cancel"/></hbox>';
-                                    xml += '<iframe style="overflow: scroll" flex="1" src="' + urls.XUL_BIB_BRIEF + '?docid=' + obj.data.marked_library.docid + '"/>';
+                                    xml += '<iframe style="overflow: scroll" flex="1" src="' + urls.XUL_BIB_BRIEF + '?docid=' + obj.data.marked_library.docid + '" oils_force_external="true"/>';
                                     xml += '</vbox>';
                                     JSAN.use('OpenILS.data');
                                     var data = new OpenILS.data(); data.init({'via':'stash'});
@@ -1258,7 +1254,6 @@ serial.manage_subs.prototype = {
     'list_init' : function( params ) {
 
         try {
-            netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
             var obj = this;
             
             JSAN.use('circ.util');
@@ -1313,7 +1308,6 @@ serial.manage_subs.prototype = {
                         return row;
                     },
                     'on_click' : function(ev) {
-                        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect UniversalBrowserRead');
                         var row = {}; var col = {}; var nobj = {};
                         obj.list.node.treeBoxObject.getCellAt(ev.clientX,ev.clientY,row,col,nobj); 
                         if ((row.value == -1)||(nobj.value != 'twisty')) { return; } // on_click runs for twistys only
diff --git a/Open-ILS/xul/staff_client/server/serial/manage_subs.xul b/Open-ILS/xul/staff_client/server/serial/manage_subs.xul
index 5dff57b..6dc5059 100644
--- a/Open-ILS/xul/staff_client/server/serial/manage_subs.xul
+++ b/Open-ILS/xul/staff_client/server/serial/manage_subs.xul
@@ -25,7 +25,6 @@ vim:noet:sw=4:ts=4:
                                 return;
                             }
                             try {
-                                netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                                 if (typeof JSAN == 'undefined') { 
                                     throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                                 }
@@ -49,7 +48,7 @@ vim:noet:sw=4:ts=4:
                 </script>
 
                 <popupset>
-                    <popup id="serial_manage_subs_popup">
+                    <menupopup id="serial_manage_subs_popup">
                         <menuitem command="cmd_add_subscriptions" label="Add Subscription"/>
                         <menuitem command="cmd_add_sdist" label="Add Distribution"/>
                         <menuitem command="cmd_add_siss" label="Add Issuance"/>
@@ -61,7 +60,7 @@ vim:noet:sw=4:ts=4:
                         <menuitem command="cmd_delete_sdist" label="Delete Distribution"/>
                         <menuitem command="cmd_delete_siss" label="Delete Issuance"/>
                         <menuitem command="cmd_delete_scap" label="Delete Caption/Pattern"/>
-                    </popup>
+                    </menupopup>
                 </popupset>
 
                 <hbox flex="1">
diff --git a/Open-ILS/xul/staff_client/server/serial/notes.xul b/Open-ILS/xul/staff_client/server/serial/notes.xul
index 207b448..ede54b9 100644
--- a/Open-ILS/xul/staff_client/server/serial/notes.xul
+++ b/Open-ILS/xul/staff_client/server/serial/notes.xul
@@ -39,7 +39,6 @@
 
 		function my_init() {
 			try {
-				netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
 				if (typeof JSAN == 'undefined') { 
 					throw( $("commonStrings").getString('common.jsan.missing') );
 				}
@@ -205,7 +204,6 @@
 			}
 
 			try {
-				netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect UniversalBrowserWrite");
 				value = value.replace(/\n/g, "&#10;"); // preserve newlines
 				var xml = '<groupbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" flex="1"> \
 					<caption label="' + label_text + '"/> \
diff --git a/Open-ILS/xul/staff_client/server/serial/sbsum_editor.js b/Open-ILS/xul/staff_client/server/serial/sbsum_editor.js
index 1dc83ac..05c4d6b 100644
--- a/Open-ILS/xul/staff_client/server/serial/sbsum_editor.js
+++ b/Open-ILS/xul/staff_client/server/serial/sbsum_editor.js
@@ -6,7 +6,6 @@ JSAN.use('serial.editor_base');
 if (typeof serial == 'undefined') serial = {};
 serial.sbsum_editor = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
         JSAN.use('OpenILS.data'); this.data = new OpenILS.data(); this.data.init({'via':'stash'});
         JSAN.use('util.network'); this.network = new util.network();
diff --git a/Open-ILS/xul/staff_client/server/serial/scap_editor.js b/Open-ILS/xul/staff_client/server/serial/scap_editor.js
index d61d99d..fef8a0f 100644
--- a/Open-ILS/xul/staff_client/server/serial/scap_editor.js
+++ b/Open-ILS/xul/staff_client/server/serial/scap_editor.js
@@ -6,7 +6,6 @@ JSAN.use('serial.editor_base');
 if (typeof serial == 'undefined') serial = {};
 serial.scap_editor = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
         JSAN.use('OpenILS.data'); this.data = new OpenILS.data(); this.data.init({'via':'stash'});
         JSAN.use('util.network'); this.network = new util.network();
@@ -140,9 +139,8 @@ serial.scap_editor.prototype = {
             obj.summarize(obj.scaps);
             obj.render();
         };
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         window.openDialog(
-            xulG.url_prefix("/xul/server/serial/pattern_wizard.xul"),
+            xulG.url_prefix("XUL_SERIAL_PATTERN_WIZARD"),
             "pattern_wizard",
             "width=800",
             onsubmit
diff --git a/Open-ILS/xul/staff_client/server/serial/sdist_editor.js b/Open-ILS/xul/staff_client/server/serial/sdist_editor.js
index ab05ba2..de14903 100644
--- a/Open-ILS/xul/staff_client/server/serial/sdist_editor.js
+++ b/Open-ILS/xul/staff_client/server/serial/sdist_editor.js
@@ -6,7 +6,6 @@ JSAN.use('serial.editor_base');
 if (typeof serial == 'undefined') serial = {};
 serial.sdist_editor = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
         JSAN.use('OpenILS.data'); this.data = new OpenILS.data(); this.data.init({'via':'stash'});
         JSAN.use('util.network'); this.network = new util.network();
diff --git a/Open-ILS/xul/staff_client/server/serial/select_aou.xul b/Open-ILS/xul/staff_client/server/serial/select_aou.xul
index 3a80153..c6f24f3 100644
--- a/Open-ILS/xul/staff_client/server/serial/select_aou.xul
+++ b/Open-ILS/xul/staff_client/server/serial/select_aou.xul
@@ -36,7 +36,6 @@
 
 		function my_init() {
 			try {
-				netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
 				JSAN.errorLevel = "die"; // none, warn, or die
 				JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/serial/select_unit.xul b/Open-ILS/xul/staff_client/server/serial/select_unit.xul
index 0347ad8..ad513c9 100644
--- a/Open-ILS/xul/staff_client/server/serial/select_unit.xul
+++ b/Open-ILS/xul/staff_client/server/serial/select_unit.xul
@@ -35,7 +35,6 @@
 
 		function my_init() {
 			try {
-				netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                 if (typeof JSAN == 'undefined') { throw( $("commonStrings").getString('common.jsan.missing') ); }
 				JSAN.errorLevel = "die"; // none, warn, or die
 				JSAN.addRepository('/xul/server/');
diff --git a/Open-ILS/xul/staff_client/server/serial/serctrl_main.xul b/Open-ILS/xul/staff_client/server/serial/serctrl_main.xul
index cde4abe..34b0f31 100644
--- a/Open-ILS/xul/staff_client/server/serial/serctrl_main.xul
+++ b/Open-ILS/xul/staff_client/server/serial/serctrl_main.xul
@@ -93,7 +93,7 @@ vim:noet:sw=4:ts=4:
 	</commandset>
 
 	<!--<popupset>
-		<popup id="serctrl_main_actions">
+		<menupopup id="serctrl_main_actions">
 			<menuitem command="cmd_add_items" label="&staff.cat.copy_browser.actions.cmd_add_items.label;" accesskey="&staff.cat.copy_browser.actions.cmd_add_items.accesskey;"/>
 			<menuitem command="cmd_edit_items" label="Edit Item Attributes" accesskey="&staff.cat.copy_browser.actions.cmd_edit_items.accesskey;"/>
 			<menuitem command="cmd_delete_items" label="Delete Item" accesskey="&staff.cat.copy_browser.actions.cmd_delete_items.accesskey;"/>
@@ -106,7 +106,7 @@ vim:noet:sw=4:ts=4:
 			<menuseparator/>
 			<menuitem command="save_columns" label="&staff.cat.copy_browser.actions.save_columns.label;"/>
 			<menuitem command="cmd_refresh_list" label="&staff.cat.copy_browser.actions.cmd_refresh_list.label;" accesskey="&staff.cat.copy_browser.actions.cmd_refresh_list.accesskey;"/>
-		</popup>
+		</menupopup>
 	</popupset> -->
 
 <!--	<groupbox flex="1" class="my_overflow"> -->
diff --git a/Open-ILS/xul/staff_client/server/serial/siss_editor.js b/Open-ILS/xul/staff_client/server/serial/siss_editor.js
index bb04131..e9deb86 100644
--- a/Open-ILS/xul/staff_client/server/serial/siss_editor.js
+++ b/Open-ILS/xul/staff_client/server/serial/siss_editor.js
@@ -6,7 +6,6 @@ JSAN.use('serial.editor_base');
 if (typeof serial == 'undefined') serial = {};
 serial.siss_editor = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
         JSAN.use('OpenILS.data'); this.data = new OpenILS.data(); this.data.init({'via':'stash'});
         JSAN.use('util.network'); this.network = new util.network();
diff --git a/Open-ILS/xul/staff_client/server/serial/sisum_editor.js b/Open-ILS/xul/staff_client/server/serial/sisum_editor.js
index 8c8a7c7..06634d8 100644
--- a/Open-ILS/xul/staff_client/server/serial/sisum_editor.js
+++ b/Open-ILS/xul/staff_client/server/serial/sisum_editor.js
@@ -6,7 +6,6 @@ JSAN.use('serial.editor_base');
 if (typeof serial == 'undefined') serial = {};
 serial.sisum_editor = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
         JSAN.use('OpenILS.data'); this.data = new OpenILS.data(); this.data.init({'via':'stash'});
         JSAN.use('util.network'); this.network = new util.network();
diff --git a/Open-ILS/xul/staff_client/server/serial/sitem_editor.js b/Open-ILS/xul/staff_client/server/serial/sitem_editor.js
index 14079f6..f057210 100644
--- a/Open-ILS/xul/staff_client/server/serial/sitem_editor.js
+++ b/Open-ILS/xul/staff_client/server/serial/sitem_editor.js
@@ -7,7 +7,6 @@ JSAN.use('serial.editor_base');
 if (typeof serial == 'undefined') serial = {};
 serial.sitem_editor = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
         JSAN.use('OpenILS.data'); this.data = new OpenILS.data(); this.data.init({'via':'stash'});
         JSAN.use('util.network'); this.network = new util.network();
diff --git a/Open-ILS/xul/staff_client/server/serial/sitem_editor.xul b/Open-ILS/xul/staff_client/server/serial/sitem_editor.xul
index aa73163..7b003ea 100644
--- a/Open-ILS/xul/staff_client/server/serial/sitem_editor.xul
+++ b/Open-ILS/xul/staff_client/server/serial/sitem_editor.xul
@@ -37,7 +37,6 @@
         <![CDATA[
             function my_init() {
                 try {
-                    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
                     if (typeof JSAN == 'undefined') { 
                         throw( document.getElementById("commonStrings").getString('common.jsan.missing') );
                     }
diff --git a/Open-ILS/xul/staff_client/server/serial/sssum_editor.js b/Open-ILS/xul/staff_client/server/serial/sssum_editor.js
index 9ab8efc..090de9d 100644
--- a/Open-ILS/xul/staff_client/server/serial/sssum_editor.js
+++ b/Open-ILS/xul/staff_client/server/serial/sssum_editor.js
@@ -6,7 +6,6 @@ JSAN.use('serial.editor_base');
 if (typeof serial == 'undefined') serial = {};
 serial.sssum_editor = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
         JSAN.use('OpenILS.data'); this.data = new OpenILS.data(); this.data.init({'via':'stash'});
         JSAN.use('util.network'); this.network = new util.network();
diff --git a/Open-ILS/xul/staff_client/server/serial/sstr_editor.js b/Open-ILS/xul/staff_client/server/serial/sstr_editor.js
index 5f3f484..0edb950 100644
--- a/Open-ILS/xul/staff_client/server/serial/sstr_editor.js
+++ b/Open-ILS/xul/staff_client/server/serial/sstr_editor.js
@@ -6,7 +6,6 @@ JSAN.use('serial.editor_base');
 if (typeof serial == 'undefined') serial = {};
 serial.sstr_editor = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
         JSAN.use('OpenILS.data'); this.data = new OpenILS.data(); this.data.init({'via':'stash'});
         JSAN.use('util.network'); this.network = new util.network();
diff --git a/Open-ILS/xul/staff_client/server/serial/ssub_editor.js b/Open-ILS/xul/staff_client/server/serial/ssub_editor.js
index ccf999a..4edef25 100644
--- a/Open-ILS/xul/staff_client/server/serial/ssub_editor.js
+++ b/Open-ILS/xul/staff_client/server/serial/ssub_editor.js
@@ -6,7 +6,6 @@ JSAN.use('serial.editor_base');
 if (typeof serial == 'undefined') serial = {};
 serial.ssub_editor = function (params) {
     try {
-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
         JSAN.use('util.error'); this.error = new util.error();
     } catch(E) {
         dump('serial/ssub_editor: ' + E + '\n');
diff --git a/Open-ILS/xul/staff_client/server/skin/custom.js.example b/Open-ILS/xul/staff_client/server/skin/custom.js.example
index b23a31f..f2dda36 100644
--- a/Open-ILS/xul/staff_client/server/skin/custom.js.example
+++ b/Open-ILS/xul/staff_client/server/skin/custom.js.example
@@ -22,7 +22,6 @@
 
 // Debugging aids.  _dump_level = 4 enables all dump statements
 try {
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     var prefs = Components.classes['@mozilla.org/preferences-service;1'].getService(Components.interfaces['nsIPrefBranch']);
     if (prefs.prefHasUserValue('oils.dump_level')) {
         _dump_level = prefs.getIntPref('oils.dump_level');
@@ -33,7 +32,6 @@ try {
 
 var _dump_prefix = '0';
 try {
-    netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
     var prefs = Components.classes['@mozilla.org/preferences-service;1'].getService(Components.interfaces['nsIPrefBranch']);
     if (!prefs.prefHasUserValue('oils.unique_id')) {
         prefs.setIntPref('oils.unique_id',Number(_dump_prefix));
diff --git a/Open-ILS/xul/staff_client/windowssetup.nsi b/Open-ILS/xul/staff_client/windowssetup.nsi
index 847eedc..e0bc1ef 100644
--- a/Open-ILS/xul/staff_client/windowssetup.nsi
+++ b/Open-ILS/xul/staff_client/windowssetup.nsi
@@ -23,6 +23,9 @@
 !define MUI_WELCOMEFINISHPAGE_BITMAP "custom_images\${UI_IMAGESET}\install.bmp"
 !define MUI_UNWELCOMEFINISHPAGE_BITMAP "custom_images\${UI_IMAGESET}\uninstall.bmp"
 
+; This should improve compression, and solves some zlib related issues with extensions
+SetCompressor /SOLID lzma
+
 ; MUI 1.67 compatible ------
 !include "MUI.nsh"
 
diff --git a/docs/RELEASE_NOTES_NEXT/new_xulrunner.txt b/docs/RELEASE_NOTES_NEXT/new_xulrunner.txt
new file mode 100644
index 0000000..3f887ea
--- /dev/null
+++ b/docs/RELEASE_NOTES_NEXT/new_xulrunner.txt
@@ -0,0 +1,60 @@
+XULRunner / Firefox
+-------------------
+Support for later versions of XULRunner is included, which means that later
+improvements to XULRunner can be taken advantage of. This also means that the
+Firefox extension mode works in Firefox 3.6+, though some frequent tweaking
+will be needed due to the rapid Firefox major release schedule.
+
+The majority of the actual changes are backend changes, but there are some
+significant things to note for local customizations.
+
+Remote XUL
+~~~~~~~~~~
+Remote XUL no longer works in XULRunner/Firefox 4+, but to work around it a
+custom extension now creates an oils:// wrapper. Within the staff client that
+wrapper contains a "remote" host, from which server-side XUL can be loaded.
+
+Custom XUL pages stored on the server will need to reference the new wrapper
+to function.
+
+As a note: The new wrapper is used for all OPAC access and only talks SSL.
+
+enablePrivilege
+~~~~~~~~~~~~~~~
+The enablePrivilege command that would allow code to access various protected
+functionality is no longer available. Any code that depended upon it will need
+to be adjusted to use the oils:// wrapper created for Remote XUL.
+
+Cookies
+~~~~~~~
+Unfortunately, the oils:// wrapper has one less than useful effect. Any
+JavaScript loaded via it loses access to cookies. This is most notable when you
+are dealing with authtoken cookies. This only applies to JavaScript, however,
+and the server can still see the cookies when it gets requests.
+
+As a workaround you can load the data stash and fetch authtokens via it instead.
+This should always work when using the oils:// wrapper due to the elevated
+permission set it gets (nearly, if not equal to, local XUL).
+
+url_prefix
+~~~~~~~~~~
+Finally, as a useful feature, the url_prefix function is now slightly easier to
+use. Instead of needing to reference urls.SOMETHING you can instead just put the
+SOMETHING at the start of the url to prefix:
+
+url_prefix('SOMETHING/stuff.html')
+
+In this case SOMETHING can be terminated by the end of the string or up to the
+first instance of a slash (/), question mark (?), or pipe (|). The pipe is a
+special case and is removed during the replacement.
+
+For example, if urls.REPLACE were set to 'oils://remote/replace':
+
+url_prefix('REPLACE/stuff') becomes 'oils://remote/replace/stuff'
+url_prefix('REPLACE?query') becomes 'oils://remote/replace?query'
+url_prefix('RPLACE|ment') becomes 'oils://remote/replacement'
+
+The pipe is intended for cases where the urls entry may or may not already
+contain a query string, say for differences between OPACs where one requires
+that something be passed into the query string, but the other uses a path
+component instead.

-----------------------------------------------------------------------

Summary of changes:
 .../src/perlmods/lib/OpenILS/WWW/EGCatLoader.pm    |    4 +-
 Open-ILS/src/perlmods/lib/OpenILS/WWW/Proxy.pm     |    3 +-
 .../src/perlmods/lib/OpenILS/WWW/Proxy/Authen.pm   |    3 +-
 Open-ILS/src/templates/base.tt2                    |    2 +-
 Open-ILS/src/templates/opac/parts/footer.tt2       |    6 +-
 Open-ILS/src/templates/opac/parts/header.tt2       |    2 +-
 Open-ILS/web/conify/global/actor/org_unit.js       |    5 +
 Open-ILS/web/conify/global/actor/org_unit_type.js  |    5 +
 Open-ILS/web/conify/global/config/copy_status.js   |    5 +
 .../web/conify/global/config/marc_code_maps.js     |    5 +
 Open-ILS/web/conify/global/permission/grp_tree.js  |    5 +
 Open-ILS/web/conify/global/permission/perm_list.js |    5 +
 Open-ILS/web/js/dojo/openils/Util.js               |    2 +-
 Open-ILS/web/js/dojo/openils/XUL.js                |   36 +-
 .../web/js/dojo/openils/widget/TranslatorPopup.js  |    8 +-
 Open-ILS/web/js/ui/base.js                         |    2 +-
 Open-ILS/web/js/ui/default/acq/common/li_table.js  |   10 +-
 .../js/ui/default/acq/financial/claim_voucher.js   |    2 +-
 Open-ILS/web/js/ui/default/actor/user/register.js  |    1 -
 Open-ILS/web/js/ui/default/booking/populator.js    |    2 +-
 Open-ILS/web/js/ui/default/cat/authority/list.js   |    3 +-
 .../web/js/ui/default/circ/selfcheck/selfcheck.js  |    2 +-
 Open-ILS/web/js/ui/default/serial/subscription.js  |    2 +-
 .../serial/subscription/caption_and_pattern.js     |    7 +-
 Open-ILS/web/js/ui/default/vandelay/vandelay.js    |    3 +-
 Open-ILS/web/opac/common/js/RemoteRequest.js       |    9 +-
 Open-ILS/web/opac/common/js/opac_utils.js          |   14 +-
 Open-ILS/web/opac/common/js/utils.js               |    2 +-
 Open-ILS/web/opac/extras/circ/alt_holds_print.html |    5 +
 Open-ILS/web/opac/locale/en-US/lang.dtd            |    2 +-
 Open-ILS/web/opac/skin/default/js/rdetail.js       |    3 +-
 Open-ILS/web/reports/oils_rpt.js                   |    4 +-
 Open-ILS/web/reports/oils_rpt_utils.js             |    2 +-
 Open-ILS/web/reports/xul/source-setup.js           |    6 +-
 Open-ILS/web/reports/xul/template-config.js        |    4 +-
 Open-ILS/web/reports/xul/template_builder.xul      |    2 +-
 Open-ILS/xul/staff_client/Makefile.am              |   60 ++-
 Open-ILS/xul/staff_client/application.ini          |    2 +-
 Open-ILS/xul/staff_client/chrome.manifest          |   27 +
 Open-ILS/xul/staff_client/chrome/chrome.manifest   |   42 --
 Open-ILS/xul/staff_client/chrome/chrome_list.jar   |  Bin 37599 -> 0 bytes
 .../staff_client/chrome/content/OpenILS/data.js    |   31 +-
 .../chrome/content/OpenILS/global_util.js          |   26 +-
 .../chrome/content/OpenILS/util_overlay_chrome.xul |    5 +-
 .../content/OpenILS/util_overlay_offline.xul       |    5 +-
 .../chrome/content/admin/survey_wizard.xul         |    1 -
 .../staff_client/chrome/content/auth/controller.js |    4 +-
 .../staff_client/chrome/content/auth/session.js    |   19 +-
 .../xul/staff_client/chrome/content/cat/opac.js    |   67 +--
 .../xul/staff_client/chrome/content/cat/opac.xul   |    1 -
 .../staff_client/chrome/content/circ/offline.js    |    3 -
 .../staff_client/chrome/content/circ/offline.xul   |    1 -
 .../chrome/content/circ/offline_checkin.js         |    2 -
 .../chrome/content/circ/offline_checkout.js        |    2 -
 .../chrome/content/circ/offline_in_house_use.js    |    2 -
 .../chrome/content/circ/offline_register.js        |    2 -
 .../chrome/content/circ/offline_renew.js           |    2 -
 .../chrome/content/firefox/overlay.xul             |   27 +-
 .../staff_client/chrome/content/main/constants.js  |  256 +++++----
 .../xul/staff_client/chrome/content/main/main.js   |  158 +++---
 .../xul/staff_client/chrome/content/main/menu.js   |  173 +++---
 .../chrome/content/main/menu_frame.xul             |    1 -
 .../chrome/content/main/menu_frame_menus.xul       |    2 +-
 .../chrome/content/main/simple_auth.xul            |    1 -
 .../staff_client/chrome/content/util/browser.js    |   18 -
 .../staff_client/chrome/content/util/browser.xul   |    8 +-
 .../staff_client/chrome/content/util/clipboard.js  |    3 -
 .../xul/staff_client/chrome/content/util/deck.js   |    2 -
 .../xul/staff_client/chrome/content/util/error.js  |    6 -
 .../chrome/content/util/fancy_prompt.xul           |    1 -
 .../xul/staff_client/chrome/content/util/file.js   |   17 -
 .../staff_client/chrome/content/util/fm_view.xul   |    1 -
 .../xul/staff_client/chrome/content/util/list.js   |    2 -
 .../chrome/content/util/list_clipboard.xul         |    1 -
 .../staff_client/chrome/content/util/mozilla.js    |    5 -
 .../staff_client/chrome/content/util/network.js    |    9 +-
 .../xul/staff_client/chrome/content/util/print.js  |   22 +-
 .../staff_client/chrome/content/util/rbrowser.xul  |    8 +-
 .../xul/staff_client/chrome/content/util/shell.js  |    2 -
 .../xul/staff_client/chrome/content/util/sound.js  |    3 -
 .../chrome/content/util/untrusted_window.xul       |   15 +
 .../chrome/content/util/widget_prompt.js           |    1 -
 .../staff_client/chrome/content/util/widgets.js    |    4 -
 .../xul/staff_client/chrome/content/util/window.js |   20 +-
 .../staff_client/chrome/content/util/xuledit.xul   |    2 +-
 Open-ILS/xul/staff_client/chrome/inspector.jar     |  Bin 698823 -> 0 bytes
 Open-ILS/xul/staff_client/chrome/skin/global.css   |    2 -
 Open-ILS/xul/staff_client/chrome/venkman.jar       |  Bin 871633 -> 0 bytes
 Open-ILS/xul/staff_client/components/clh.js        |  357 ++++-------
 .../xul/staff_client/components/forceexternal.js   |  165 ++----
 .../staff_client/components/inspector-cmdline.js   |  179 ------
 .../xul/staff_client/components/nsIOpenILS.idl     |    6 -
 .../xul/staff_client/components/nsIOpenILS.xpt     |  Bin 156 -> 0 bytes
 Open-ILS/xul/staff_client/components/nsOpenILS.js  |  100 ++--
 .../xul/staff_client/components/oils_protocol.js   |   64 ++
 .../xul/staff_client/components/venkman-service.js |  619 --------------------
 .../defaults/preferences/standalone_xul_app.js     |    4 +-
 .../xul/staff_client/external/dojo_template.js     |    1 -
 Open-ILS/xul/staff_client/external/template.js     |    3 -
 Open-ILS/xul/staff_client/external/template.xul    |    3 +-
 Open-ILS/xul/staff_client/install.rdf              |    4 +-
 Open-ILS/xul/staff_client/server/admin/adminlib.js |    8 +
 .../staff_client/server/admin/circ_age_to_lost.js  |    1 -
 .../staff_client/server/admin/copy_locations.js    |    8 +
 .../admin/do_not_auto_attempt_print_setting.js     |    1 -
 .../staff_client/server/admin/font_settings.xul    |    3 -
 .../server/admin/hold_pull_list_classic.js         |    1 -
 Open-ILS/xul/staff_client/server/admin/index.xhtml |    4 +-
 .../server/admin/offline_manage_xacts.js           |   27 +-
 .../server/admin/offline_manage_xacts.xul          |    1 -
 .../staff_client/server/admin/org_unit_settings.js |    5 +
 .../server/admin/patrons_due_refunds.js            |    2 -
 .../server/admin/patrons_due_refunds.xul           |    4 +-
 .../server/admin/printer_settings.html             |   61 --
 .../staff_client/server/admin/printer_settings.js  |    6 -
 .../staff_client/server/admin/printer_settings.xul |   68 +++
 .../staff_client/server/admin/stat_cat_editor.js   |    8 +
 Open-ILS/xul/staff_client/server/admin/toolbar.js  |    1 -
 .../xul/staff_client/server/admin/transit_list.xul |    5 +-
 .../xul/staff_client/server/admin/upload_xacts.js  |    3 +-
 Open-ILS/xul/staff_client/server/admin/work_log.js |    1 -
 .../xul/staff_client/server/admin/work_log.xul     |    8 +-
 Open-ILS/xul/staff_client/server/cat/bib_brief.js  |    7 +-
 .../xul/staff_client/server/cat/bibs_abreast.js    |    5 +-
 .../xul/staff_client/server/cat/bibs_abreast.xul   |    2 +-
 .../xul/staff_client/server/cat/copy_browser.js    |   21 +-
 .../xul/staff_client/server/cat/copy_browser.xul   |    5 +-
 .../xul/staff_client/server/cat/copy_buckets.xul   |    1 -
 .../staff_client/server/cat/copy_buckets_quick.xul |    1 -
 .../xul/staff_client/server/cat/copy_editor.js     |    3 -
 .../xul/staff_client/server/cat/copy_notes.xul     |    2 -
 .../xul/staff_client/server/cat/copy_summary.xul   |    1 -
 .../server/cat/manage_multi_home_items.js          |    2 -
 .../server/cat/manage_multi_home_items.xul         |    4 +-
 Open-ILS/xul/staff_client/server/cat/marc_new.xul  |    8 +-
 .../xul/staff_client/server/cat/marc_view.html     |    2 -
 Open-ILS/xul/staff_client/server/cat/marc_view.xul |    5 +-
 Open-ILS/xul/staff_client/server/cat/marcedit.js   |   17 +-
 Open-ILS/xul/staff_client/server/cat/marcedit.xul  |  140 +++---
 .../xul/staff_client/server/cat/record_buckets.js  |   12 +-
 .../xul/staff_client/server/cat/record_buckets.xul |    2 -
 .../server/cat/record_buckets_quick.xul            |    1 -
 .../xul/staff_client/server/cat/spine_labels.js    |    3 -
 Open-ILS/xul/staff_client/server/cat/util.js       |   23 +-
 .../xul/staff_client/server/cat/volume_buckets.xul |    1 -
 .../staff_client/server/cat/volume_copy_creator.js |    7 +-
 .../staff_client/server/cat/volume_copy_editor.js  |    1 -
 .../staff_client/server/cat/volume_copy_editor.xul |    4 +-
 .../server/cat/volume_copy_editor_horiz.xul        |    4 +-
 .../xul/staff_client/server/cat/volume_editor.js   |    1 -
 Open-ILS/xul/staff_client/server/cat/z3950.js      |   22 +-
 Open-ILS/xul/staff_client/server/cat/z3950.xul     |    3 +-
 .../server/circ/alternate_copy_summary.js          |    1 -
 Open-ILS/xul/staff_client/server/circ/checkin.xul  |    1 -
 .../staff_client/server/circ/checkin_overlay.xul   |    4 +-
 Open-ILS/xul/staff_client/server/circ/checkout.js  |    3 +-
 Open-ILS/xul/staff_client/server/circ/checkout.xul |    1 -
 .../xul/staff_client/server/circ/circ_brief.xul    |    1 -
 .../xul/staff_client/server/circ/circ_summary.xul  |    1 -
 .../xul/staff_client/server/circ/copy_details.xul  |    1 -
 .../xul/staff_client/server/circ/copy_status.js    |   14 +-
 .../xul/staff_client/server/circ/copy_status.xul   |    1 -
 .../server/circ/copy_status_overlay.xul            |   10 +-
 .../xul/staff_client/server/circ/in_house_use.xul  |    1 -
 .../xul/staff_client/server/circ/missing_pieces.js |    1 -
 .../staff_client/server/circ/pre_cat_fields.xul    |    1 -
 .../server/circ/print_list_template_editor.js      |    8 +-
 .../server/circ/print_list_template_editor.xul     |    3 +-
 Open-ILS/xul/staff_client/server/circ/renew.xul    |    1 -
 .../xul/staff_client/server/circ/renew_overlay.xul |    4 +-
 Open-ILS/xul/staff_client/server/circ/util.js      |   12 +-
 Open-ILS/xul/staff_client/server/index.xhtml       |   11 +-
 Open-ILS/xul/staff_client/server/main/data.xul     |   14 +-
 .../server/main/gen_offline_widgets.xul            |    5 -
 .../xul/staff_client/server/main/simple_auth.xul   |    1 -
 Open-ILS/xul/staff_client/server/main/ws_info.xul  |    3 -
 .../staff_client/server/patron/barcode_entry.xul   |    3 +-
 Open-ILS/xul/staff_client/server/patron/bill2.js   |    3 -
 Open-ILS/xul/staff_client/server/patron/bill2.xul  |    4 +-
 .../staff_client/server/patron/bill_cc_info.xul    |    1 -
 .../staff_client/server/patron/bill_check_info.xul |    1 -
 .../xul/staff_client/server/patron/bill_details.js |    2 -
 .../xul/staff_client/server/patron/bill_history.js |    1 -
 .../xul/staff_client/server/patron/bill_wizard.js  |    1 -
 Open-ILS/xul/staff_client/server/patron/display.js |   26 +-
 .../xul/staff_client/server/patron/display.xul     |    2 -
 .../staff_client/server/patron/display_horiz.xul   |    2 -
 .../xul/staff_client/server/patron/hold_details.js |    3 -
 Open-ILS/xul/staff_client/server/patron/holds.js   |   32 +-
 Open-ILS/xul/staff_client/server/patron/holds.xul  |    1 -
 .../staff_client/server/patron/holds_overlay.xul   |    6 +-
 .../xul/staff_client/server/patron/info_group.js   |   14 +-
 .../xul/staff_client/server/patron/info_group.xul  |    4 +-
 .../xul/staff_client/server/patron/info_notes.xul  |    2 -
 .../staff_client/server/patron/info_stat_cats.xul  |    1 -
 .../staff_client/server/patron/info_surveys.xul    |    1 -
 Open-ILS/xul/staff_client/server/patron/items.js   |    4 +-
 Open-ILS/xul/staff_client/server/patron/items.xul  |    1 -
 .../staff_client/server/patron/items_overlay.xul   |    8 +-
 .../xul/staff_client/server/patron/place_hold.js   |    2 -
 .../xul/staff_client/server/patron/search_form.xul |    2 -
 .../server/patron/search_form_horiz.xul            |    2 -
 .../staff_client/server/patron/search_result.xul   |    1 -
 Open-ILS/xul/staff_client/server/patron/staged.js  |    4 +-
 Open-ILS/xul/staff_client/server/patron/staged.xul |    4 +-
 .../server/patron/standing_penalties.js            |    4 -
 .../server/patron/standing_penalties.xul           |    4 +-
 Open-ILS/xul/staff_client/server/patron/summary.js |    2 -
 .../xul/staff_client/server/patron/summary.xul     |    5 -
 .../staff_client/server/patron/summary_overlay.xul |    4 +-
 .../server/patron/summary_overlay_horiz.xul        |    8 +-
 .../staff_client/server/patron/user_buckets.xul    |    2 -
 Open-ILS/xul/staff_client/server/patron/util.js    |    4 +-
 .../staff_client/server/serial/batch_receive.js    |   12 +-
 .../xul/staff_client/server/serial/editor_base.js  |    1 -
 .../xul/staff_client/server/serial/manage_dists.js |   10 +-
 .../staff_client/server/serial/manage_dists.xul    |    5 +-
 .../xul/staff_client/server/serial/manage_items.js |    2 +-
 .../staff_client/server/serial/manage_items.xul    |    5 +-
 .../xul/staff_client/server/serial/manage_subs.js  |    8 +-
 .../xul/staff_client/server/serial/manage_subs.xul |    5 +-
 Open-ILS/xul/staff_client/server/serial/notes.xul  |    2 -
 .../staff_client/server/serial/pattern_wizard.js   |    7 +-
 .../xul/staff_client/server/serial/sbsum_editor.js |    1 -
 .../xul/staff_client/server/serial/scap_editor.js  |    6 +-
 .../xul/staff_client/server/serial/sdist_editor.js |    1 -
 .../xul/staff_client/server/serial/select_aou.xul  |    1 -
 .../xul/staff_client/server/serial/select_unit.xul |    1 -
 .../staff_client/server/serial/serctrl_main.xul    |    4 +-
 .../xul/staff_client/server/serial/siss_editor.js  |    1 -
 .../xul/staff_client/server/serial/sisum_editor.js |    1 -
 .../xul/staff_client/server/serial/sitem_editor.js |    1 -
 .../staff_client/server/serial/sitem_editor.xul    |    1 -
 .../xul/staff_client/server/serial/sssum_editor.js |    1 -
 .../xul/staff_client/server/serial/sstr_editor.js  |    1 -
 .../xul/staff_client/server/serial/ssub_editor.js  |    1 -
 .../xul/staff_client/server/skin/custom.js.example |    2 -
 Open-ILS/xul/staff_client/windowssetup.nsi         |    3 +
 docs/RELEASE_NOTES_NEXT/new_xulrunner.txt          |   60 ++
 239 files changed, 1311 insertions(+), 2404 deletions(-)
 create mode 100644 Open-ILS/xul/staff_client/chrome.manifest
 delete mode 100644 Open-ILS/xul/staff_client/chrome/chrome_list.jar
 create mode 100644 Open-ILS/xul/staff_client/chrome/content/util/untrusted_window.xul
 delete mode 100644 Open-ILS/xul/staff_client/chrome/inspector.jar
 delete mode 100644 Open-ILS/xul/staff_client/chrome/venkman.jar
 delete mode 100644 Open-ILS/xul/staff_client/components/inspector-cmdline.js
 delete mode 100644 Open-ILS/xul/staff_client/components/nsIOpenILS.idl
 delete mode 100644 Open-ILS/xul/staff_client/components/nsIOpenILS.xpt
 create mode 100644 Open-ILS/xul/staff_client/components/oils_protocol.js
 delete mode 100644 Open-ILS/xul/staff_client/components/venkman-service.js
 delete mode 100644 Open-ILS/xul/staff_client/server/admin/printer_settings.html
 create mode 100644 Open-ILS/xul/staff_client/server/admin/printer_settings.xul
 create mode 100644 docs/RELEASE_NOTES_NEXT/new_xulrunner.txt


hooks/post-receive
-- 
Evergreen ILS


More information about the open-ils-commits mailing list