Storyline 3.18.28642.0 publishing breaks tincan tracking -- forbidden

It's a trigger when you hit Next on the results slide.  It is in a separate javascript file in our system.  That script is found because of these statements in our aspx module that runs our training:

<script type="text/javascript" src="/js/track.js"></script>

function injecttracking() {
var head = this.contentDocument.getElementsByTagName("head")[0];
var scr = this.contentDocument.createElement('script');
scr.type = 'text/javascript';
scr.src = '/js/track.js';
head.appendChild(scr);
}
window.onunload = reloadParent;
$(function () {
$('iframe').on('load', injecttracking).on('unload', reloadParent);
});

Other browsers find it just fine.  Only firefox has the issue.