Storyline 3.18.28642.0 publishing breaks tincan tracking -- forbidden

One other note -- I did see an Articulate article that says:  Don't include <script type="text/javascript"> in your code

Our injecttracking does have <script type="text/javascript"> and </script> around it, but taking that out just causes our source to show up in a window behind the training.  This happens in all browsers and doesn't make any difference as far as behavior is concerned.