Demonstration of ineffective iframe sandboxing options