sandboxed js evaluation