Allow configuration of iframe src attribute

Not sure if you have an alternate thought on how to solve this problem, but the change is simple enough that kicking it off with a pull request makes sense to me.

**Inspiration:**

In my org, we're planning to ship with [Content Security Policy](https://developer.mozilla.org/en-US/docs/Security/CSP/Introducing_Content_Security_Policy) enabled.

This poses a minor problem with the iframe transport, which uses ```src="javascript:false;"```, leading to the following error (in Firefox, Chrome gives a similar error):

```Content Security Policy: Directive inline script base restriction violated```

**Proposed Solution:**

Allow the user of the iframe transport to configure the iframe's src attribute.  Default to the old behavior, ```javascript:false;```.

In my org, all the browsers we plan on supporting handle ```about:blank```, so we could go with that, fixing the issue and preventing any error from getting logged.