I also find it interesting that they define allowed websockets, but don't define which iFrames are allowed.