<!--
Thanks for opening an issue! A few things to keep in mind:

- The issue tracker is only for bugs and feature requests.
- Before reporting a bug, please try reproducing your issue against
  the latest version of Electron.
- If you need general advice, join our Slack: http://atom-slack.herokuapp.com
-->

* Electron version: 1.6.5
* Operating system: macOS

### Expected behavior

Preload script can be loaded even if CSP is enabled

### Actual behavior

Preload script is prevented from being loaded by CSP

### How to reproduce

<!-- 

Your best chance of getting this bug looked at quickly is to provide a REPOSITORY that can be cloned and run.

You can fork https://github.com/electron/electron-quick-start and include a link to the branch with your changes.

If you provide a URL, please list the commands required to clone/setup/run your repo e.g.

  $ git clone $YOUR_URL -b $BRANCH
  $ npm install
  $ npm start || electron .

-->

I could not prepare server with CSP, so let me show the sequence to reproduce with my app...

1. Download v0.2.2 from https://github.com/rhysd/Mstdn/releases
2. Unarchive it and copy [this config.json](https://gist.github.com/rhysd/9f656d4e93f40fe2e41752dfbe08cdc5) to `~/Application Support/Mstdn/config.json`
3. Open app with `$ NODE_ENV=development /path/to/Mstdn.app/Contents/MacOS/Mstdn`
4. It will open DevTools for browser window. Console tab should show the error.

In my app, browser window is opened with `nodeIntegration: false` and `preload: '...'` web preferences for external URL https://mstdn.jp where CSP is enabled.

Above sequence show following error.

<img width="800" alt="2017-04-25 0 53 55" src="https://cloud.githubusercontent.com/assets/823277/25346121/b8e7cf7c-2951-11e7-92bd-1b6c12193461.png">

It says that `eval` cannot be used because of CSP. The `eval` is used at VM28:784 for loading preload script specified with `preload: '...'` option on creating `BrowserWindow` instance.

Following is a screenshot of the code:

<img width="912" alt="2017-04-25 0 57 17" src="https://cloud.githubusercontent.com/assets/823277/25346295/2f126c98-2952-11e7-8186-9d4f5756a630.png">

Preload script is loaded with `eval()` function but it is blocked. Is it possible to remove the check by CSP while loading preload script?
Preload script is a way for loading some user script even if Node integration is disabled for external browser AFAIK. So, if it is blocked by CSP, preload script can no longer used for injecting some code to external page safely.
atom/renderer/atom_sandboxed_renderer_client.cc
v8::Handle<v8::Context> context,
    const std::string& callback_name,
    std::vector<v8::Handle<v8::Value>> args) {
  auto* isolate = context->GetIsolate();
  auto binding_key = mate::ConvertToV8(isolate, kIpcKey)->ToString();
  auto private_binding_key = v8::Private::ForApi(isolate, binding_key);
  auto global_object = context->Global();
  v8::Local<v8::Value> value;
  if (!global_object->GetPrivate(context, private_binding_key).ToLocal(&value))
    return;
  if (value.IsEmpty() || !value->IsObject())
    return;
  auto binding = value->ToObject();
  auto callback_key = mate::ConvertToV8(isolate, callback_name)->ToString();
  auto callback_value = binding->Get(callback_key);
  DCHECK(callback_value->IsFunction());  
  auto callback = v8::Handle<v8::Function>::Cast(callback_value);
  ignore_result(callback->Call(context, binding, args.size(), args.data()));
}
}