disallow capi and ffi within sandboxed context