Sandboxed iframes fixes

Postmessage to "*" for improved security, eh...?