Add a content-security-policy (CSP) flag.

lib/compiler/implementation/js_backend/backend.dart

Index: lib/compiler/implementation/js_backend/backend.dart
diff --git a/lib/compiler/implementation/js_backend/backend.dart b/lib/compiler/implementation/js_backend/backend.dart
index 72b09d7e5885ba9ef4a81324cf19d8d9a66c0b3d..a196406cf33fb5ebae21bece76cbd1a90cda1a8c 100644
--- a/lib/compiler/implementation/js_backend/backend.dart
+++ b/lib/compiler/implementation/js_backend/backend.dart
@@ -667,13 +667,17 @@ class JavaScriptBackend extends Backend {
     return <CompilerTask>[builder, optimizer, generator, emitter];
   }
 
-  JavaScriptBackend(Compiler compiler, bool generateSourceMap)
+  JavaScriptBackend(Compiler compiler,
+                    bool generateSourceMap,
+                    bool disableEval)
       : namer = new Namer(compiler),
         returnInfo = new Map<Element, ReturnInfo>(),
         invalidateAfterCodegen = new List<Element>(),
         interceptors = new Interceptors(compiler),
         super(compiler, JAVA_SCRIPT_CONSTANT_SYSTEM) {
-    emitter = new CodeEmitterTask(compiler, namer, generateSourceMap);
+    emitter = disableEval
+        ? new CodeEmitterNoEvalTask(compiler, namer, generateSourceMap)
+        : new CodeEmitterTask(compiler, namer, generateSourceMap);
     builder = new SsaBuilderTask(this);
     optimizer = new SsaOptimizerTask(this);
     generator = new SsaCodeGeneratorTask(this);