Isn't this as safe as just posting to an SSL page? If there is a MITM-attack they will just replace the contents of the iframe to another page?