Sandboxed iframe (opaque origin). document.origin =