Content-Security-Policy fix for the iframe init process.

Instead of using an inline event handler, attach the (simpler) event
handler before adding the iframe to the outer DOM.