Exercise path to production env
Add XSS exercise and make fixes to sandboxing