When I do run a GET request within an `<iframe sandbox="allow-scripts" />` to an URI on the same origin of the iframe, the request fails with the error:

`DOMException: Failed to read the 'cookie' property from 'Document': The document is sandboxed and lacks the 'allow-same-origin' flag.`

The issue is actually caused by the XHR adapter, while reading the cookies, since you can't access cookies in a sandboxed iframe:

```
// Add xsrf header
  // This is only done if running in a standard browser environment.
  // Specifically not if we're in a web worker, or react-native.
  if (utils.isStandardBrowserEnv()) {
    var cookies = require('./../helpers/cookies');

    // Add xsrf header
    var xsrfValue = config.withCredentials || isURLSameOrigin(config.url) ?
        cookies.read(config.xsrfCookieName) :
        undefined;

    if (xsrfValue) {
      requestHeaders[config.xsrfHeaderName] = xsrfValue;
    }
  }
```

I'm willing to submit a PR to fix it, but I'm actually wondering what's the best approach in your opinion (according to the axios design):
1. Add a try/catch in `helpers/cookies.js` `read()` function and `return null` on error
2. Add an option to disable the XSRF header, or implicitely disable it if `config.xsrfHeaderName === null`
3. ... any other suggestion is welcome

Thank you,
Marco

lib/adapters/xhr.js
request.ontimeout = function handleTimeout() {
      reject(createError('timeout of ' + config.timeout + 'ms exceeded', config, 'ECONNABORTED'));
      
      request = null;
    };
    
    
    
    if (utils.isStandardBrowserEnv()) {
      var cookies = require('./../helpers/cookies');
      
      var xsrfValue = config.withCredentials || isURLSameOrigin(config.url) ?
          cookies.read(config.xsrfCookieName) :
          undefined;
      if (xsrfValue) {
        requestHeaders[config.xsrfHeaderName] = xsrfValue;
      }
    }
    
    if ('setRequestHeader' in request) {
      utils.forEach(requestHeaders, function setRequestHeader(val, key) {
        if (typeof requestData === 'undefined' && key.toLowerCase() === 'content-type') {
          
          delete requestHeaders[key];
        } else {
          
          request.setRequestHeader(key, val);
        }
      });
    }