I am sandboxed but with "allow-same-origin" click me