Support for `allow-popups`

The application can grant specific privileges to the sandbox, like opening windows.

```js
  var sandbox = oasis.createSandbox({
    url: 'http://example.com/profile_viewer.html',
    capabilities: [ 'account' ],
    sandbox: {
      popups: true,
    }
  });
```