Closes #1414

Summary of changes:
This removes the sandbox attribute from the iframe.
As @mfranzke pointed out: Based on the following statement, the attribute is kind of pseudo security

When the embedded document has the same origin as the embedding page, it is strongly discouraged to use both allow-scripts and allow-same-origin, as that lets the embedded document remove the sandbox attribute — making it no more secure than not using the sandbox attribute at all.