I think he'd have a better idea what that meant, but my understanding was that it might be possible to use a data uri for an iframe src and skip the extra request while getting sandboxing?