Is this true? Can they grab the iframe src and pass it on to give access elsewhere?