PASS Verify blob URLs are loaded with sandbox iframes