Harden against attacks from rendered items

[pfrazee]

https://github.com/pfraze/machine/wiki/Security-Design

• [x] Sanitize HTML
• [x] Sanitize CSS
• [x] Disallow IDs
• [ ] Prefix all layer1 classes with 'layer1-' and disallow use of that prefix
• [ ] Review CSP
• [ ] Audit requests generated from rendered HTML and from Workers
• [ ] Review bootstrap components
• [ ] Remove the target-based exceptions from Local.js' request events so that all clicks/submits result in request-events

[pfrazee]

Resources:

https://code.google.com/p/google-caja/wiki/JsHtmlSanitizer https://developer.mozilla.org/en-US/docs/Web/API/DOMParser https://developer.mozilla.org/en-US/Add-ons/Code_snippets/HTML_to_DOM

var oParser = new DOMParser();
var oDOM = oParser.parseFromString('<div>'+html+'</div>', "text/html");
update.html = oDOM.body.innerHTML;

[pfrazee]

Related: #50