Replace `javascript:void(0)` with `#`

Fixes:
- issues with content security policy (#1215)
- onbeforeunload in IE (#403)

We don't need to add a preventDefault because all clicks on
.chzn-container already have a preventDefault