This module now works, and has no known security issues, but still has one bug: when submitting a new node, the experiment ID does not get inserted into the database, and the node has to be edited, the experiment ID re-added, and the node saved. That work-around does allow the user to assign an experiment ID to a node.