if loaded over ssl and iframe is whitelisted, set its source to https