The user has previously saved a password for this origin. The page embeds
a same-URL-origin iframe with sandbox="allow-scripts", which
therefore commits with an opaque security origin and (with
kIsolateSandboxedIframes default-on) runs in its own renderer
process.