Fix #45.

HTML Sandboxes should be verified according to the sandbox URL, not Oasis's URL.
Merge pull request #46 from tildeio/fix-same-origin-check-html-sandboxes

Fix #45.