more xss stuff
xss fixes for iframe