use regex for iframe installer origin whitelist

logic might be off