use regex for iframe installer origin whitelist

It'd mean third-party apps could trigger app install requests from the m.f.c origin.