Some users are still having problems with the pop-up login. I think they are actually getting 403s because of the CSRF protection. So I have modified the base template to always have a javascript variable called csrf_token available when they aren't logged in. The ajax_login.js script was then modified to send this value with the ajax post. Fingers crossed.

[
    {
        "pk": 1, 
        "model": "oembed.provider", 
        "fields": {
            "api_endpoint": "http://www.youtube.com/oembed", 
            "name": "YouTube", 
            "url_regex": "^http://www\\.youtube\\.com/watch\\?v=\\S+$", 
            "format": 0
        }
    }
]