This is a sandbox document:
Content-Security-Policy: sandbox allow-popups