title: high-order function causes unsafe eval in chrome extension
body: <p>I am making a very simple chrome extension to randomly change the wallpaper on my chromebook. But I am getting a strange error in the Javascript console after I load it:</p>
  
  <blockquote>
    <p>Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' blob: filesystem: chrome-extension-resource:". @ background.js:27</p>
  </blockquote>
  
  <p>Here is my manifest.json:</p>
  
  <pre><code>{
    "manifest_version": 2,
  
    "name": "Abyss Wallpapers for Chrome OS",
    "description": "Sets the Chrome OS wallpaper to a random wallpaper from the
                        Wallpaper Abyss (wall.alphacoders.com), once a minute",
    "version": "1.0",
    "background":
    {
      "scripts":["background.js"]
    },
    "permissions": [
      "wallpaper",
      "https://wall.alphacoders.com/api2.0/",
      "background"
    ]
  }
  </code></pre>
  
  <p>And here is my background.js:</p>
  
  <pre><code>var baseUrl = "https://wall.alphacoders.com/api2.0/get.php?"
  var apiKey = "c160c64ef4c79e61e325ddf944183dfe"
  var params = "auth=" + apiKey + "&amp;method=random"
  var interval = 30000;
  var xhr = new XMLHttpRequest();
  xhr.open("GET", baseUrl + params, true);
  xhr.onreadystatechange = function()
  {
    if (xhr.readyState == 4 &amp;&amp; xhr.status == 200)
    {
      var data = xhr.responseText;
      if (data.success)
      {
        chrome.wallpaper.setWallpaper
        (
          {url:data.wallpapers[1].url_image,
          layout:"CENTER_CROPPED",
          filename:data.wallpapers[1].id + "." + data.wallpapers[1].file_type},
          function(thumbnail)
          {
            thumbnail = null;
          }
        )
      }
    }
  }
  setInterval(xhr.send(), interval);
  </code></pre>
  
  <p>It appears that it is rejecting the <code>setInterval()</code> method, but there is no eval or even a string there.</p>
  
  <p>EDIT: So I changed the <code>setInterval()</code> statement to reflect Bergi's answer, and now the background script runs for about a minute, meaning that the interval was set, but I get another error after that:</p>
  
  <blockquote>
    <p>Uncaught InvalidStateError: Failed to execute 'send' on 'XMLHttpRequest': The object's state must be OPENED.(anonymous function) @ background.js:27</p>
  </blockquote>
  
  <p>Why would the object not be open when I specifically called <code>xhr.open()</code> in line 5?</p>