Prevent XSS iframe exploit

The responsive viewer took an absolute url as an query arg, for its iframe src. Make this a relative url, with the hostname keyed indirectly by an arg. To prevent naughty URLs being passed in.