improved heading in 'in-application sandboxing'