added default route for iframe escape, need for embedded apps
refactoring
updated readme