This is a sandboxed document:
Content-Security-Policy: sandbox allow-popups allow-pointer-lock allow-scripts