Sandbox should let author specify base path

Currently, we assume that the broker is running in `src/` and prepend all guest script URLs with `../`. This breaks absolute URLs and is generally inflexible.

The sandbox should allow users to set a `basePath` property that is prepended to guest script paths. The broker should not change the URLs it is given.
