Improve security model for non sandboxed iframes.

Oasis ensures that iframes are loaded from a separate domain
if the browser does not support the sandbox attribute.

This restriction can be avoided by setting
`Oasis.config.allowSameOrigin` to true.