fixing sandbox, removed allow-scripts