...
We definitely need to validate onSubmit, and we should prevent/interrupt the submit from completing if the data is denied.
How
Through trial and error I learned that you can only talk to the PTAEO via Script Includes and Background Scripts, but not directly from Client Scripts.
However, you may be able to invoke the Script Includes from a Client Script.
Making things messier, you cannot XMLParse with XMLDocument in a Background Script; XML parsing only in a Client Script. Uggggh.
So I'm envisioning a Script Include I have to invoke from a client script, passing it arguments somehow, and then getting back an XML hunk that I have to parse in a client script.