feat(external_api): set permissions for cross-origin iframe
In Chrome M63 a warning is shown, permissions won't be automatically allowed
afterwards. Reference:
https://sites.google.com/a/chromium.org/dev/Home/chromium-security/deprecating-permissions-in-cross-origin-iframes
Setting this early makes us future proof, while working with current versions
too: Chrome < 63 gives an error because it doesn't understand the option and
Firefox seems to ignore it, so both continue to work as before.