use regex for iframe installer origin whitelist

very good point.