using a chrome uri and system principal allows me to get around the cross site permission stuff when using cross domain iframes