added comment documenting why we allow unsafe-eval at /test/.