Initial version with iframe whitelisting and onebox boilerplate