"He found he could bypass the sandbox but reformatting the request, such as file://request to a remote server." . . . .