changed hasEval logic to always test for eval when CSP securityPolicy.allowsEval is true