disallow javascript protocol in IFrameURL