I'm a <object> inside an iframe which is sandboxed with 'allow-scripts allow-forms'