added allow-same-origin to sandbox attribute of iFrame to prevent JS bug that was killing bootstrap popovers