use manual iframe sandbox instead of VM.

A persistent environment is needed for things like XHR, setTimeout, etc.
And dynamically creating an iframe causes weird things like about: to be
the base protocol.

only save or requires if code is valid. also always request all deps
from browserify-cdn as a single bundle.
fix last result output in chrome