I am sandboxed but with "allow-scripts allow-same-origin"