[FOR DISCUSSION] Add 'sandboxed' option. If set to false, iframe is not sandboxed.

This is useful for cases where you want oasis services but don't care about the oasis security model (i.e. you control code inside and outside the iframe).

Thoughts?