Wrapping full preview in iframe to protect XSS