2 posts.
The viewer and the PDF have to be served over the same protocol. The fix was moving both to SSL.
A stale lock in the options table blocks updates until you delete one row.