It's CORS most likely.
I'll embed the sandbox on my next deployment.