[iframely] allow cross origin access by config 'allowedOrigins'