* Use the Jinja sandbox to render themes * Prevent get_config from accessing config.py values * Add get_app_config * Add tests for sandbox