Only do callgate emulation when calling from within a sandbox.

To support this we need to track when we are currently in a sandbox.