The ability to disable or restrict certain parts of the Pluto API, e.g. `js_invoke`. Also should be considered for #3 and #4.
