Check html is an iframe if not wrap it

[djowett]

Just noting this security consideration from the oembed spec before I forget...

"When a consumer displays HTML (as with video embeds), there's a vector for XSS attacks from the provider. To avoid this, it is recommended that consumers display the HTML in an iframe, hosted from another domain. This ensures that the HTML cannot access cookies from the consumer domain."

(unless this is handled in your dependencies?)

[hvelarde]

good point, thanks!