iframe sandbox: allow scripts