title: Cannot start Aurelia app without eval()
body: <p>I have a working Aurelia SPA web app, but if I set in my web.config the Content-Security-Policy option like this</p>
  
  <pre><code>&lt;add name="X-Content-Security-Policy" value="default-src 'none'; frame-src 'self'; script-src 'self' https://code.jquery.com; connect-src 'self' https://*.core.windows.net; img-src 'self' data:; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; font-src https://fonts.gstatic.com 'self';"&gt;&lt;/add&gt;
  </code></pre>
  
  <p>I get this error on page load</p>
  
  <pre><code>Uncaught (in promise) Error: (SystemJS) Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' https://code.jquery.com".
  </code></pre>
  
  <p>I loaded the page now using the unbundled version and the error I get is</p>
  
  <pre><code>EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline' 'self' https://code.jquery.com".
  
  Evaluating https://localhost/jspm_packages/npm/aurelia-bootstrapper@1.0.0.js
  Error loading https://localhost/jspm_packages/npm/aurelia-bootstrapper@1.0.0.js
  </code></pre>
  
  <p>in the meantime I will investigate the SystemJS module loader further.</p>
  
  <p><b>UPDATE</b></p>
  
  <p>The error happens indeed in the SystemJS module loader, because in system.src.js it uses eval (plus a couple of 'new Function' definitions, but I don't come tho those lines of code.
  My question would then be: is there no way to work around this other than switching off the Content-Security-Policy (or allowing 'unsafe-eval')?</p>