Only allow iframe embedding on same origin.