JavaScript specs for a sandboxed web