A sandboxed iframe with 'allow-scripts'