Run iframe in sandbox, fixes noflo/noflo-ui#99