Moved inline script in iframe.html to index.js and implement allowedDomains check
Allow only same domain urls by default, and only http/https protocol
0.4.0