removing eval in all but one place (Composer._export, and heavily filtering its use there)
Merge branch 'master' into gh-pages
security updates (removing eval). upping version. should be all backwards compatible, but if not, tagged 0.8.7 release.