iframe URL is now escaped