webapp: use sandboxed iframe instead of webview.