Make private.js safe to use in non-ES5 environments.

This requires polyfilling Object.defineProperty and Object.create when
those methods are not built in.
Add some basic tests to be run by `npm test`.

It's hard to test security guarantees, but it's certainly important to
make sure basic functionality never regresses.
Add a .travis.yml file to enable hosted testing.