security: Prevent arbitrary method invocation on conditions in if tag.

@bouk & @fw42 for review

## Problem

The if tag allows arbitrary method invocation on a Condition object.  Pull #273 restricted this to just public methods, but didn't completely fix the issue.

## Solution

We only need to handle the two boolean operators, "and" and "or", so we can easily check a whitelist before calling the method.