add feed package origins to iframe whitelist