accept connections only in sandboxed mode