Replaces global protection with sandboxing

The sandbox is configured by the elements in the table
on line 621. Some things I have blacklisted in the sandbox
by default - the justifications are in the code.

I have yet to investigate the performance impact of this
change - it could be large, we'll see.