Factor WeakMap dependency out

Now relying on an independently maintained package for WeakMap,
https://github.com/drses/weak-map in hope that it will be kept better
up-to-date as a collaborative effort with the Google Caja team.

Might fix #6

Fixes #20