fail(
  "documents sandboxed without allow-scripts should NOT be able to run <script src=...>"
);