fix security policy issues with accessing iframe