minimal js access of iframe content

attempt to avoid #448