Disable cross-domain access by default. See GH-89 and GH-63.
Merge pull request #90 from scrapinghub/no-iframes-hack-by-default

[MRG] Disable cross-domain access by default.