added Makefile and iframe.js
rolling back cross-domain iframe, but using an iframe now to prevent CSS leakage