Defense against Mutation XSS attacks [WIP]

[vojtech-dobes]

Fixes #88. Work in progress.

/cc @mishak87: is this correct approach? If this is correct implementation of TrueHTML, then 2 points must be resolved:

• TrueHTML cannot be used if Object.defineProperty is not available (or broken in IE8) OR XmlSerializer isn't available
• if TrueHTML cannot be used:
  • 1. HTML must be sanitized in different way
  • 2. nette.ajax.js will refuse to update snippet
  • 3. nette.ajax.js will update snippet but scream about security hole