main
fix(core): treat iframe credentialless as security-sensitive
fix(compiler): disallow translations of iframe src