use regex for iframe installer origin whitelist

Hm, didn't think about our certs. What about non-privileged packaged apps?