Restore behaviour after BC change in JSON.decode

fixes #1264

JSON.decode defaults to secure since 1.5. This code was relying on
`eval()`, so by forcing JSON.decode to unsecure the code works again

Added new spec to cover this