fix($parse): disallow access to window and dom in expressions