I am sandboxed with 'allow-same-origin allow-scripts'