Make sure we check return values.  Default to send stdout.  #3522.
Refine security design - only allow transfers of files in the sandbox. #3522