use regex for iframe installer origin whitelist

why not do a regex for the packaged app whitelist too?