I get the feeling this is more an issue of trust then technical details. Why don't you trust the web developers to use the full power of perl? Why must you use technical means to enforce social constraints? I seem to recall reading that this generally doesn't work. I could think of several semi bad to just bad things a web developer could do just in html/javascript. You obviously trust them not to do this, so why not trust them with perl?

If you are more concerned with protecting other systems from the web developers accidents, then why not use some form of user permissions to strictly control what the webdev's can actually touch?