go back to JSON.parse, realized there was still potential for code injection