Some extra checks to help prevent misuse of DOM apis in the insecure/buggy angular expressions

Adding a function call to each key will probably hurt performance pretty bad? Does that matter for the CSP case?

How about setting the `eso` vars to something falsy instead of identity and down below just do `eso && eso(pathVal[key#])` (no assignment) - that way the normal case won't have the extra function calls...