added iframe protection, and action checks