Remove `allow-same-origin` and sandboxes in test run on a separate domain/port