Support for `allow-popups` and `allow-forms`

The application can grant specific privileges to the sandbox, like opening windows or submitting forms.

```js
  var sandbox = Oasis.createSandbox({
    url: 'http://example.com/profile_viewer.html',
    capabilities: [ 'account' ],
    sandbox: {
      popups: true,
      forms: true
    }
  });
```