don't allow calls to init, run, evaluate from JS