relax sandbox permissions now that contract error message
construction requires looking at the filesystem

assuming this is the right fix, it closes PR 13634