When I do run a GET request within an `<iframe sandbox="allow-scripts" />` to an URI on the same origin of the iframe, the request fails with the error:

`DOMException: Failed to read the 'cookie' property from 'Document': The document is sandboxed and lacks the 'allow-same-origin' flag.`

The issue is actually caused by the XHR adapter, while reading the cookies, since you can't access cookies in a sandboxed iframe:

```
// Add xsrf header
  // This is only done if running in a standard browser environment.
  // Specifically not if we're in a web worker, or react-native.
  if (utils.isStandardBrowserEnv()) {
    var cookies = require('./../helpers/cookies');

    // Add xsrf header
    var xsrfValue = config.withCredentials || isURLSameOrigin(config.url) ?
        cookies.read(config.xsrfCookieName) :
        undefined;

    if (xsrfValue) {
      requestHeaders[config.xsrfHeaderName] = xsrfValue;
    }
  }
```

I'm willing to submit a PR to fix it, but I'm actually wondering what's the best approach in your opinion (according to the axios design):
1. Add a try/catch in `helpers/cookies.js` `read()` function and `return null` on error
2. Add an option to disable the XSRF header, or implicitely disable it if `config.xsrfHeaderName === null`
3. ... any other suggestion is welcome

Thank you,
Marco

lib/adapters/xhr.js
if (config.withCredentials) {
      request.withCredentials = true;
    }
    
    if (config.responseType) {
      try {
        request.responseType = config.responseType;
      } catch (e) {
        if (request.responseType !== 'json') {
          throw e;
        }
      }
    }
    
    if (typeof config.progress === 'function') {
      if (config.method === 'post' || config.method === 'put') {
        request.upload.addEventListener('progress', config.progress);
      } else if (config.method === 'get') {
        request.addEventListener('progress', config.progress);
      }
    }
    if (requestData === undefined) {
      requestData = null;
    }
    
    request.send(requestData);
  });
};