The `_sandbox` value returned by `decode_receipt` is only correct for the top-level receipt, not for IAP data.