I am sandboxed with 'allow-scripts allow-same-origin'