fixes  #6132 always show opt out iframe on all domains, do not secure the iframe