Allow sub-domains from blocked domain to onebox

Manual testing confirms that this specific part of the iframe is the issue. Changing it to just src works as expected (See third post on this topic)