An `<iframe>` has only `sandbox=""` (empty value, no tokens). Which behavior still works inside that frame?