Block remote code execution

[bweengener]

User Story:
As a host, I don’t want users to be able to arbitrarily execute code on my server to ensure the integrity of the polls and ensure user’s can’t hack me/ cheat.

[florian-str]

An old issue (#124) describes the problem in more detail:

With access to perform: and similar messages, one could wreak havoc and circumvent any security measurements put in place. We should guard against this, possibly by only allowing messages to be sent that are implemented directly on the object that's messaged (and not inherited handlers).