use regex for iframe installer origin whitelist

fwiw, if we're already including `localhost` in the whitelist, does having a whitelist really help much?