Fixed CORS check when target host property is empty.
Added iframe to xml converter. Closes #2286.