A sandboxed iframe can communicate back to its originating site.

Use `allowSameOrigin` to add the `allow-same-origin` flag on the `sandbox` attribute of an iframe.

```js
oasis.configure('allowSameOrigin', true);
```

Also put back the security for same origin for IE8/9.

Enforcing a different origin between the container and the iframe prevents from creating a sandbox using the default Oasis URL on browsers that don't support the `sandbox` attribute.