make ad location its own part of config, new test, make iframes not allow funny business w/ sandbox attribute