use regex for iframe installer origin whitelist

Yeah that could work