Fix CSP

This PR adds `'unsafe-eval'` to the CSP in order to fix #141.