I am sandboxed but with "allow-same-origin" and "allow-scripts"