Use sandbox.client.endpoint instead of relying on window.location.origin

This is more reliable, first of all because we don't replicate the endpoint
logic everywhere, and then because IE doesn't implement window.location.origin