Restrict .scr to run as an unprivileged user without network or filesystem access, that always launches the system login/unlock on exit?

This seems better than having a program that does random web requests to put ads on the lock screen.