sandbox with allow-same-origin sandbox without flags