When I do run a GET request within an `<iframe sandbox="allow-scripts" />` to an URI on the same origin of the iframe, the request fails with the error:

`DOMException: Failed to read the 'cookie' property from 'Document': The document is sandboxed and lacks the 'allow-same-origin' flag.`

The issue is actually caused by the XHR adapter, while reading the cookies, since you can't access cookies in a sandboxed iframe:

```
// Add xsrf header
  // This is only done if running in a standard browser environment.
  // Specifically not if we're in a web worker, or react-native.
  if (utils.isStandardBrowserEnv()) {
    var cookies = require('./../helpers/cookies');

    // Add xsrf header
    var xsrfValue = config.withCredentials || isURLSameOrigin(config.url) ?
        cookies.read(config.xsrfCookieName) :
        undefined;

    if (xsrfValue) {
      requestHeaders[config.xsrfHeaderName] = xsrfValue;
    }
  }
```

I'm willing to submit a PR to fix it, but I'm actually wondering what's the best approach in your opinion (according to the axios design):
1. Add a try/catch in `helpers/cookies.js` `read()` function and `return null` on error
2. Add an option to disable the XSRF header, or implicitely disable it if `config.xsrfHeaderName === null`
3. ... any other suggestion is welcome

Thank you,
Marco

test/specs/xsrf.spec.js
});
  });
  it('should set xsrf header if cookie is set', function (done) {
    document.cookie = axios.defaults.xsrfCookieName + '=12345';
    axios('/foo');
    getAjaxRequest().then(function (request) {
      expect(request.requestHeaders[axios.defaults.xsrfHeaderName]).toEqual('12345');
      done();
    });
  });
  it('should not set xsrf header for cross origin', function (done) {
    document.cookie = axios.defaults.xsrfCookieName + '=12345';
    axios('http://example.com/');
    getAjaxRequest().then(function (request) {
      expect(request.requestHeaders[axios.defaults.xsrfHeaderName]).toEqual(undefined);
      done();
    });
  });
  it('should set xsrf header for cross origin when using withCredentials', function (done) {
    document.cookie = axios.defaults.xsrfCookieName + '=12345';
    axios('http://example.com/', {
      withCredentials: true
    });
    getAjaxRequest().then(function (request) {
      expect(request.requestHeaders[axios.defaults.xsrfHeaderName]).toEqual('12345');
      done();
    });
  });
});