eval() in a straitjacket: sandboxing JavaScript under CSP