disallow javascript protocol in IFrameURL

An authenticated user is allowed to publish URLs containing the javascript: protocol. This pull request will throw an error if this protocol is used
Please add docblock, something like:

    /**
     * Ensure that the IFrameURL is a valid url and prevents XSS
     * 
     * @throws ValidationException
     * @return ValidationResult
     */