use safeeval, not saving cookie