check if iframe allowed