Load Apps Sandboxed

An attempt at #2007

- Based on suggestions from @gotdibbs, loading with an eval approach
- Load relative modules in child sandboxes
- Now works with nested relative links

This gets a little hairy because of things like __dirname getting set to the core/server/apps path when we `eval`, but it's a decent start after some hackery.  I feel like the test cases give some faithful things a person might try and be sneaky about.

I know @sebgie mentioned a more white list than black list approach, but I wasn't sure how to do that.  Feedback welcome.