Try forcing no referer on iframe?