Minor cleanup in defaults
Move call to QWebSecurityOrigin.addLocalScheme to splash.server, so it is called only once
Add unit test for accesing external iframe from js