Really only allow apps.facebook.com to embed the site.