s from the frames.
      window.addEventListener('message', function (e) {
        // Normally, you should verify that the origin of the message's sender
        // was the origin and source you expected. This is easily done for the
        // unsandboxed frame. The sandboxed frame, on the other hand is more
        // difficult. Sandboxed iframes which lack the 'allow-same-origin'
        // header have "null" rather than a valid origin. This means you still
        // have to be careful about accepting da