switched iframeSandbox to a postMessage injection api