Exacerbating cross-site scripting: the iframe sandwich