add option for iframe URLs

[pyramation]

we should make an option to expose functionality so we don't need to hardcode URLs like this #486

cc @adairrr @noahsaso

[noahsaso]

the app dev can override them, those are just the defaults because DAO DAO and Abstract are trusted domains