Address jack's additional comments in code review

Test Plan:
- Load my modified test.html, check iframe to see that it has origin=localhost appended to its URL

Auditors: jack