try to fix xss issue with iframe