Remote connection fails with CSP violation

[Gudahtt]

When attempting to connect to a local server, I see the following error:

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

It looks like this feature executes a string as JavaScript, which is disallowed by the current CSP.

[Gudahtt]

Probably related to #1755