Allow eval() and send headers for legacy browsers

The blocking of eval() seems to have problems with JQuery 1.7.2 - let's allow it for now and disable it in the future.