corrected sandbox argument value

documentation to "sandbox" attribute (http://www.w3schools.com/tags/att_iframe_sandbox.asp) said about "allow-forms" possible value, not "allow-form".