Allow only JavaScript until sandboxing completed for others