use regex for iframe installer origin whitelist

If an attacker can get the user to run something on localhost, I think they're already boned, right?