FAIL: Sandboxed iframe XHR access allowed.