completed message sandboxing and added iframe click re-emit (close #24)