Can it be assumed that content within an iframe is on-site hosted even if the information is from another domain?