Use a safer test for isExpression

It is now safe to use `isConstant` on un-trusted input, but it is still
not safe to use `toConstant` on un-trusted input.
Release 3.0.1