expressJS sandbox