I feel like the browser could use the Content-Type header to check whether the response is JSON or actual executable javascript - throwing an error if the former
Your suggestions are totally spot on. The doodling is pretty minimal and needs to have more widgets/features (akin to snapchat).
As you said, I think there are lots of services which let you send uploaded images as postcards. However they are marketed as "serious" services and don't come across as "fun" to use.
My buddy and I created ImagePoke over the course of a week as a side project. We're pretty new to web development, so we're learning a lot as we go.
The idea for ImagePoke is pretty simple:
1) Upload/Provide a URL for an image
2) Crop said image
3) Doodle on said image
4) Provide recipient address details
5) Provide payment ($3.00) via stripe
6) Doodled image arrives at recipient's address as a postcard in ~ 7 days
We've got full "account" support (at the end of the process you can create an account that stores recipient addresses and payment methods), but this is optional.
Any suggestions/criticisms would be massively appreciated, as I said, we're both quite new at this..