Issue 1386 add iframe channel

We should also check the host against the iframe whitelist.