Block `\href{javascript:evil}` links in math.  Fixes #13.