If Mighty is feeling cavalier they can cut some of the JS sandboxing and go straight to hypervisor level sandboxing.