use regex for iframe installer origin whitelist

Since I can set my packaged app origin to whatever I want (and not sure if reviewers will catch if apps set their origin to m.f.c or m.a.o).