changed JSON.parse replacement to something slightly safer than eval