Set allowScriptAccess attribute as never

This should be a temporary solution for this security defect, we are going to make some formal fix on this in the future.