Removed allow-scripts from iframe sandbox attribute