Merge pull request #269 from googlecodelabs/marcacohen-patch-1

clarify security restriction

Author: nicolasgarnier

FORMAT-GUIDE.md

@@ -68,7 +68,7 @@ You can also use this to target specific events, for instance:  \
     Iframes can be embedded by doing:
      - Add an image in the document. The image can be a screenshot of the iframe for instance but it doesn't really matter since it won't be displayed but replaced by the embedded iframe.
      - Add an "Alt Text" to the image by doing **Cmd+Opt+Y** or **Right click > "Alt Text..."**
-     - Put a full URL in the **Description** field of the Alt Text. in the format `https://www.domain.com/watch?foo=bar`. Note that for security reasons, iframe embbedding is limited to https URLs.
+     - Put a full URL in the **Description** field of the Alt Text. in the format `https://www.domain.com/watch?foo=bar`. Note that for security reasons, iframe embbedding is limited to an enumerated set of allowable iframe source URLs. Feel free to submit a PR if you'd like to augment that list or tweak your own version of the claat command.
 
 1. Info Boxes