So I fixed the first one. I was indeed injecting the token in the iframe but it was tied to the click event for setting the url which was too soon since the url hadn't loaded yet in the iframe. I added an event handler for the iframe onload event and then injected the token and now works as expected.
However I'm still getting a not found error for the api call for the tiles operation. It's as if there isn't a listerner on the other end using the format I referenced above. Thank You