Fix XSS live rendering hole

Currently the rendered output can access anything in its parent window. With the new Github auth and other possibly sensitive data in the page, this hole needs to be tightened up.

The fix is to live render in an iframe on a different domain, and sandbox it tightly. This means a 'runner' on a different domain (run.jsbin.com) that can communicate with the outer page.

The obvious tech to do this with is postMessage, but that would lose IE7 support. So we'll progressively enhance the support from a working IE7 version up to postMessage.

### Tasks

- [x] Immediately load an iframe with runner in it, on different domain
- [x] Pass in the current bin's URL to be rendered in a sub-iframe
- [x] Sub-iframe keeps itself up-to-date using event source ([polyfill](https://github.com/remy/polyfills/blob/master/EventSource.js))
- [x] Make runner listen for postMessage if available
- [x] Create postMessage rendering protocol: config, code, events need to be passed back and forth
- [x] Proxy the dynamic iframe's console in & out to the jsbin console using postMessage
- [x] Disable this by default
- [ ] Browser testing (focus on IE7)
- [x] Build script for runner

### Notes

- This should be off by default as it requires custom DNS setup, but JS Bin should be deployable in as many environments as possible.