Yes, we're using a sandboxed iframe which will eventually have to have the allow-scripts capability (although it doesn't yet).