I am not from Yahoo. I'd like to help you after going through the pain in Small View and Canvas View.
1) Caja is subset of JavaScript. Caja won't help you to clean your XML. You must have included unacceptable tags within your XML. Check Caja Documentation.
2) Yes external JavaScript and CSS are not allowed on Canvas View. Use this to make your Caja JS
http://cajadores.com/demos/testbed/Read Documentation here
http://developer.yahoo.com/yap/guide/caja-support.html3) After you create new application and verify your app, you will be able to access Application Editor to test/preview page.
Multiple Views
With each app, you can develop and deploy a "Small view" and "Canvas view". The Canvas view is a stand-alone web page that gives you full freedom to flex your technology muscles. The Small view gets added into existing Yahoo! properties and services when they add your application. We'll start with Small view support on My Yahoo! then add other popular Yahoo! Services in the future.