Use Knockout without unsafe-eval / content security policy