bump gleak;
Fix shell injection vulnerability.

send() was shelling out using `echo` to write to sendmail's
stdin. This opened the possibility of shell injection if your
email body contained something like:

    var evil_body = "$(touch /tmp/evil_access && cat /etc/passwd)";

This commit makes send() spawn sendmail directly (without making a new shell)
and then writes to sendmail's stdin.
release 0.2.6