block scripts in iframe, use dataurl to prevent referer content block
add css selector helper  #3

using postMessage instead of parent.parent