- adding sandbox+seamless to iframe
- adding csrf tocken to getHtmlBody call