DOM access in sandbox="allow-same-origin" iframe