iframe isolation, fixes #1