Fix severe security issue: XSS with arbitrary code execution

There's a gaping security hole in the current version of Countable.js.
https://rob.lekensteyn.nl/Countable/ demonstrates and explains the problem.

This PR contains a fix for this issue, and a fix for another unrelated bug.