Avoid IFrame Content Security Policy

Some sites used Content Security Policy. https://w3c.github.io/webappsec/specs/content-security-policy/
These sites refused iframe without permitted domain (e.g. https://github.com/).
This patch modify iframe URL to use source page's scheme and domain.
Merge pull request #27 from ninjinkun/avoid-iframe-content-policy

Avoid IFrame Content Security Policy