I should be loaded by a form submit from a sandbox with 'allow-forms'