use regex for iframe installer origin whitelist

Yeah, my first patch was using a catch-all whitelist, but after some comments from @diox, we tightened up the security.