base-uri works correctly inside a sandboxed iframe.