Add 'sandbox' attribute to popup iframe to prevent redirects