OFApplication: Disallow using a different sandbox

While the active sandbox can be changed, a different sandbox must not be
activated. The reason for this is that allowing to activate a different
sandbox makes it impossible to track which paths have already been
unveiled.