sandboxing, timers, xhr