need graceful fallback for sites not supporting cross-origin iFrames

[balmas]

We have a temporary workaround coded for Safari, but we need a more general solution. Sites which use the Content-Security-Policy header to restrict access to iframes will not work with our WindowIFrame destination.

The follow is a start at thinking through a solution but it needs more work.