Replaces scripting global protection with call sandboxing

As mentioned may be worth doing in #1725.

This does impose a larger performance penalty on scripting calls, though - a new environment is copied for each call, and that's fairly expensive. Are there any thoughts on this approach?