Set type='content' on iframe for preview to prevent remote code injection vulnerability.