Would be nice if the client could do oAuth, so we could test oAuth APIs, not just SharedSecret ones.

Assuming this talks to -dev, a form that lets you choose which server we are using would be great: eg: dev, stage, prod

STR:

1. Load http://marketplay.paas.allizom.org/
2. Select Rocketfuel -> post /api/v1/rocketfuel/collections/
3. Select collection name, description and author name to be <script>alert('problem')</script>
4. Submit the request

Voila! XSS :)

The search at the top doesn't do anything and most of the footer isn't relevant either, lets remove all that.

To show someone an example of how to get twitter details, I have to say:

Go to here, click apps, then the second get, then enter twitter, etc.

Would be awesome if we could have a link to that. This means figuring out a scheme for the URLs and keeping the URL bar up to date as we go along.

1. click accounts link
2. click post /api/v1/account/feedback/ link
3. click "Send Request" button
4. notice the console:

Failed to load resource: the server responded with a status of 400 (BAD REQUEST)