fix `new Function(<string>)` allowing for arbitrary code execution

[iameli]

Pay attention to the security note — I'm really not sure if there's a way to hack around this or not. But this at least makes us consistent with CF workers in the common case.

fixes #146