In most javascript sandboxes if you request a domain from an site you are restricted by the same content policy. This makes it harder to do things like make requests to sites for example that don't use https when your on one that does use it.

https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...