- fixed frameset: need to undo iframe logic and reload scripts
- add localhost to default whitelist
- TODO cleanup