allow sanitize without iframe