`<iframe>`s are fine. I'll merge our pull requests and add a rule to only allow iframes.