Fixing path to chrome app samples in documentation

chrome/common/extensions/docs/templates/articles/app_external.html

 <h1>External Content</h1>
 
 
 <p>
 The <a href="app_architecture#security">Chrome Apps security model</a> disallows
 external content in iframes and
 the use of inline scripting and <code>eval()</code>.
 You can override these restrictions,
 but your external content must be isolated from the app.
 </p>
 
 <p>
 Isolated content cannot directly
 access the app's data or any of the APIs.
 Use cross-origin XMLHttpRequests
 and post-messaging to communicate between the event page and sandboxed content
 and indirectly access the APIs.
 </p>
 
 <p class="note">
 <b>API Sample: </b>
 Want to play with the code?
 Check out the
-<a href="https://github.com/GoogleChrome/chrome-app-samples/tree/master/sandbox">sandbox</a> sample.
+<a href="https://github.com/GoogleChrome/chrome-app-samples/tree/master/samples/sandbox">sandbox</a> sample.
 </p>
 
 <h2 id="external">Referencing external resources</h2>
 
 <p>
 The <a href="contentSecurityPolicy">Content Security Policy</a> used by apps disallows
 the use of many kinds of remote URLs, so you can't directly reference external
 images, stylesheets, or fonts from an app page. Instead, you can use use
 cross-origin XMLHttpRequests to fetch these resources,
 and then serve them via <code>blob:</code> URLs.
@@ skipping 34 matching lines @@
 </pre>
 
 <p>You may want to <a href="offline_apps#saving-locally">save</a>
 these resources locally, so that they are available offline.</p>
 
 <h2 id="webview">Embed external web pages</h2>
 
 <p class="note">
 <b>API Sample: </b>
 Want to play with the code? Check out the
-<a href="https://github.com/GoogleChrome/chrome-app-samples/tree/master/browser">browser</a>
+<a href="https://github.com/GoogleChrome/chrome-app-samples/tree/master/samples/browser">browser</a>
 sample.
 </p>
 
 <p>
 The <code>webview</code> tag allows you to embed external web content in your
 app, for example, a web page. It replaces iframes that point to remote URLs,
 which are disabled inside Chrome Apps. Unlike iframes, the
 <code>webview</code> tag runs in a separate process. This means that an exploit
 inside of it will still be isolated and won't be able to gain elevated
 privileges. Further, since its storage (cookies, etc.) is isolated from the app,
@@ skipping 198 matching lines @@
 
 <pre data-filename="sandboxed.html">
 var messageHandler = function(e) {
   console.log('Background script says hello.', e.data);
 };
 
 window.addEventListener('message', messageHandler);
 </pre>
 
 <p class="backtotop"><a href="#top">Back to top</a></p>