fix check for cross-origin iframe