The sandbox iframe will set the postmessage message.origin property to 'null'.