Let users write rules without letting them write JavaScript

Evaluate user-defined expressions like pricing and filter rules at runtime, with no eval, no new Function, and a strict CSP left intact.