Generalize secure js content policy in FW6

[ralflang]

See discussion in #15

[midahp]

since the email is displayed in an iframe, I was wondering if we could add the sandbox attribute to the iframe to prevent some xss attacks.

I created an PR for that: #19