Avoid IFrame Content Security Policy

Some sites used Content Security Policy.
https://w3c.github.io/webappsec/specs/content-security-policy/ These sites
refused iframe without permitted domain (e.g. https://github.com/). This patch
modify iframe URL to use source page's scheme and domain.