A sandboxed iframe must be able to redirect the top-level page, but only after the user clicks something inside the frame (never automatically on load). Which token fits?
<iframe sandbox="allow-scripts allow-top-navigation-by-user-activation"
src="widget.html"></iframe>