use regex for iframe installer origin whitelist

so, maybe we should check that the protocol is indeed https:// for firefox.com/allizom.org (not localhost) domains. That way, if an attacker can MITM http://something.firefox.com, it won't help him here.