title: Can't use Raphael JS to draw a path in a Chrome extension popup because of security policy?
body: <p>If I try to use Raphael to draw a path in the default_popup page for my Chrome extension:</p>
  
  <pre><code>r.path("M0,0L10,10");
  </code></pre>
  
  <p>I get the following error:</p>
  
  <pre><code>Uncaught EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' chrome-extension-resource:".
  </code></pre>
  
  <p>I understand the need to disallow eval() and things like that, but why is this "evaluating a string as JavaScript"?  Is there any alternative way to generate the path without the path string besides setting an unsafe security policy that would also wind up allowing eval()?</p>