make origins for iframe/host be set by settings.js