test: reject unsafe live lab inputs before network access