Iframe Whitelisting by URI instead of hostname.