Fix #45.

HTML Sandboxes should be verified according to the sandbox URL, not Oasis's
URL.