Back to DENY

Because it totally makes sense!
Merge pull request #1841 from jsbin/fix/deny-iframes

Back to DENY