locking down use of eval in a lot of places (including Composer). also locking down JSON.decode to use the "secure" bit, meaning it wont eval (it uses JSON.parse instead). removing some old cruft thats no longer needed.