prevent constructing arbitrary function using 'Function'