use regex for iframe installer origin whitelist

having mp.dev in there would help, since that's what docker sets up for you