Added allow-same-origin to iframe sandbox

Brad mentioned in #394 that allow-same-origin might be necessary for pages requiring logins.