using window.open instead, iframe sucks