Add sandbox for iframes

Again, I'm not sure whether this will work or not--the current concern is YouTube Flash iframes--but a second pair of eyes would be nice.