Restore behaviour after BC change in JSON.decode

JSON.decode defaults to secure since 1.5. This code was relying on
`eval()`, so by forcing JSON.decode to unsecure the code works again

Added new spec to cover this
Merge pull request #1265 from SergioCrisostomo/fix-JSONdecode-validator

Restore behaviour after BC change in JSON.decode