[xwalk-2152] Fix sandbox security

- Use colored div element instead of image element
- Add 'allow-same-origin' in allow-forms tests

Impacted tests(approved): new 0, update 1, delete 0
Unit test platform: [Android]
Unit test result summary: pass 1, fail 0, block 0
Merge pull request #29 from haoxli/webapi/xwalk-2152

[xwalk-2152] Fix sandbox security