Disallow javascript protocol in IFrameURL using a whitelist of allowed schemes. Includes unit testing and a docblock to IFramePage validate function to explain exceptions and return types