Improve security model for non sandboxed iframes.

Oasis ensures that iframes are loaded from a separate domain
if the browser does not support the sandbox attribute.

This restriction can be avoided by setting
`Oasis.config.allowSameOrigin` to true.
Merge pull request #33 from tildeio/verify_sandbox

Improve security model for non sandboxed iframes.