ok(
  false,
  "documents sandboxed with allow-scripts should NOT be able to run <script src=...>"
);