fixed eploits.
Merge pull request #25 from bcoe/exploit-fix

Fixed two major exploits pointed out in #21
Merge remote-tracking branch 'upstream/master'

Conflicts:
	lib/sandbox.js