I should be loaded by a form submit from a window opened from a sandbox with 'allow-forms allow-same-origin'.