use regex for iframe installer origin whitelist

oh, right the `installs_allowed_from`. I totally forgot. that's what this protects, thanks!