use regex for iframe installer origin whitelist

myevildomainthatendswithfirefox.com matches this regexp.