You could make it quite hard for the user to get the url, but it'll require more coding. What you can do is give the iframe an id and on load of the page on the client side, you can call a webservice via AJAX and get the url. You can then use document.getElementById('iframe_id').src = url returned by web service.
You can make the web service require some data on the page in order to return the url. That might make it harder to get the url by other means. This is not foolproof, but is pretty good.