PASS: Sandboxed iframe XHR access allowed.