Remove sandbox options from header when sandbox is disabled

The "body format" and "request format" options show in the header even when the sandbox is disabled. As far as I can tell they are only used for the sandbox (if I'm wrong then this PR will obviously not be needed).

Adding an `{% if enableSandbox %}` wrapper to the relevant header div seems to solve it; tests still run and I don't observe any JavaScript errors.