disallow javascript protocol in IFrameURL

An authenticated user is allowed to publish URLs containing the javascript: protocol. This pull request will throw an error if this protocol is used