fixed up tests that were lying

It seemed like the the 'injectInto' option
would expose most props by default. This was
not the case. That was formerly hidden by
using the getConfig call that added props
that were never used in the actual implementation.

Added another test to make this more explicit.
Will add docs on this.

test/sandbox-test.js

@@ -2111,6 +2111,7 @@ describe("Sandbox", function () {
             describe("ajax options", function () {
                 it("yields server when faking xhr", function () {
                     const sandbox = createSandbox({
+                        useFakeServer: true,
                         properties: ["server", "stub", "mock"],
                     });
 
@@ -2153,6 +2154,8 @@ describe("Sandbox", function () {
                 it("yields clock when faking timers", function () {
                     const sandbox = createSandbox({
                         properties: ["server", "clock"],
+                        useFakeServer: true,
+                        useFakeTimers: true,
                     });
 
                     assert.same(sandbox.args[0], this.fakeServer);
@@ -2161,42 +2164,37 @@ describe("Sandbox", function () {
                     sandbox.restore();
                 });
 
-                it("injects properties into object", function () {
+                it("should inject server and clock when enabling them", function () {
                     const object = {};
 
                     const sandbox = createSandbox({
-                        properties: ["server", "clock"],
                         injectInto: object,
+                        properties: ["clock", "server", "requests"],
+                        useFakeTimers: true,
+                        useFakeServer: true,
                     });
 
                     assert.equals(sandbox.args.length, 0);
                     assert.equals(object.server, this.fakeServer);
                     assert.clock(object.clock);
-                    assert.isUndefined(object.spy);
-                    assert.isUndefined(object.stub);
-                    assert.isUndefined(object.mock);
-                    assert.isUndefined(object.requests);
+                    assert.isArray(object.requests);
 
                     sandbox.restore();
                 });
 
-                it("should inject server and clock when only enabling them", function () {
+                it("should not inject server and clock if not enabled, even if the props are whitelisted", function () {
                     const object = {};
 
                     const sandbox = createSandbox({
                         injectInto: object,
-                        useFakeTimers: true,
-                        useFakeServer: true,
+                        properties: ["clock", "server", "requests"],
+                        useFakeTimers: false,
+                        useFakeServer: false,
                     });
 
-                    assert.equals(sandbox.args.length, 0);
-                    assert.equals(object.server, this.fakeServer);
-                    assert.clock(object.clock);
-                    assert.isFunction(object.spy);
-                    assert.isFunction(object.stub);
-                    assert.isFunction(object.mock);
-                    assert.isArray(object.requests);
+                    assert.isUndefined(object.requests);
                     assert.isUndefined(object.sandbox);
+                    assert.isUndefined(object.clock);
 
                     sandbox.restore();
                 });
@@ -2247,6 +2245,16 @@ describe("Sandbox", function () {
 
             sandbox.restore();
         });
+
+        it("does not inject any properties by default", function () {
+            const object = {};
+
+            createSandbox({
+                injectInto: object,
+            });
+
+            assert.equals(Object.keys(object), []);
+        });
     });
 
     describe("getters and setters", function () {