Add `command_id` to embedded iframe/img IDs for router exploits

This prevents a race condition where duplicate iframes/imgs are
created if a module is run twice simultaneously. The second iframe/img
was not being removed during `cleanup()`.