Safe showHtmlInFrame

Turns out the previous algorithm was actually flawed. This should sandbox properly.

As a plus, the dependency on srcdoc has been dropped too.