Fix severe security issue: XSS with arbitrary code execution

There's a gaping hole in Countable.js v1.4. 
https://rob.lekensteyn.nl/Countable/ demonstrates and explains this security problem.

This PR contains a fix for this issue, and a fix for another unrelated bug.