Allow hosted loop client access to our iframe-install message API (bug 1040278)

https://bugzilla.mozilla.org/show_bug.cgi?id=1040278
https://bugzilla.mozilla.org/show_bug.cgi?id=1008990
wait, should these have trailing slashes?