adding iframe to whitelist