* enable sandbox * enable CSP (umami tentatively works?) and reduce amount of ipc APIs exposed * remove csp from index