Use Express for demo accounts instead of Express XL

app/controllers/api/rmq_utils_controller.rb

@@ -174,12 +174,12 @@ module Api
       if farmbot_demo?
         a, b, c = (routing_key_param || "").split(".")
 
-        if !["read"].include?(permission_param)
+        if !(permission_param == "read")
           deny
           return
         end
 
-        unless a == DEMO_REGISTRY_ROOT
+        if !(a == DEMO_REGISTRY_ROOT)
           deny
           return
         end

app/controllers/dashboard_controller.rb

@@ -65,8 +65,6 @@ class DashboardController < ApplicationController
         response.headers["Cache-Control"] = "no-cache, no-store"
         response.headers["Pragma"] = "no-cache"
         response.headers["Expires"] = "0"
-        response.headers["X-Frame-Options"] =
-          "ALLOWALL" if [:main_app, :demo].include?(actn)
         load_css_assets
         load_js_assets
         render actn

app/mutations/devices/seeders/demo_account_seeder.rb

@@ -1,6 +1,6 @@
 module Devices
   module Seeders
-    class DemoAccountSeeder < ExpressXlOneZero
+    class DemoAccountSeeder < ExpressOneZero
       BASE_URL = "/app-resources/img/demo_accounts/"
       FEEDS = {
         "Express XL" => "Express_XL_Demo_Webcam.JPG",

spec/controllers/api/rmq_utils/rmq_utils_controller_spec.rb

@@ -220,7 +220,6 @@ describe Api::RmqUtilsController do
                    "demos.d3f91ygdrajxn8jk.d3f91ygdrajxn8jk",
                    nil]
 
-  # it "invalidates sneaky guest topic names" do
   device_8 = "device_#{FactoryBot.create(:device).id}"
   possible_attackers = [
     # ["username", "permission"]