A sandboxed iframe can communicate back to its originating site.

```js
oasis.configure('allowSameOrigin', true);
```

Also put back the security for same origin for IE8/9.

Enforcing a different origin between the container and the iframe prevents from
creating a sandbox using the default Oasis URL (as it needs to be hosted
on a separate domain).
Merge pull request #68 from tildeio/fix_tutorial

A sandboxed iframe can communicate back to its originating site.
Improve XHR detection
Merge pull request #69 from tildeio/fix_oasis_xhr

Improve XHR detection