use regex for iframe installer origin whitelist

yeah, this is true. I forgot we lifted that restriction (for anyone). we should probably not do that. but I'm not sure that's still a real issue, because you still need certs from us to install privileged packaged apps. maybe I'm missing something.