set sandbox attr

this should prevent iframe scripts from messing with parent
doc