Do an origin check on an iframe's parent. If the origin is not whitelisted, send the user to the `/illegal_iframe` endpoint.