title: chrome packaged app doesn't allows unsafe-eval in knockout.js
body: <p>I've developed an web app and uploaded it on my Google chrome apps as unpacked extension. During the execution I receive the following error:   </p>
  
  <blockquote>
    <p>Refused to evaluate a string as JavaScript because 'unsafe-eval' is
    not an allowed source of script in the following Content Security
    Policy directive: "default-src 'self' chrome-extension-resource:".
    Note that 'script-src' was not explicitly set, so 'default-src' is
    used as a fallback. <strong>[knockout-3.0.0-min.js:54]</strong></p>
  </blockquote>
  
  <p>adding <code>"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"</code> to the manifest.json results in a message:  </p>
  
  <blockquote>
    <p>'content_security_policy' is only allowed for extensions and legacy
    packaged apps, but this is a packaged app.</p>
  </blockquote>
  
  <p>does it mean that I can not use knockous.js for developing apps for chrome app store?</p>
  
  <p>How to fix this problem?</p>