security warning for sandbox="allow-same-origin allow-scripts"