Sandboxed frame without allow-scripts