allow/sandbox attr changed after document creation, before response