sandbox="allow-same-origin allow-scripts allow-forms"