how did it break the sandbox? I felt like the article just jumped us into "it has GET privileges now".