iframe isolation, fixes #1

this makes it so `evel("{}.__proto__") === Object.prototype` returns `false` :-)