Function() called as a constructor should throw without 'unsafe-eval' script-src directive.