added allow-scripts to sandbox of iframe