use regex for iframe installer origin whitelist