Replace pickle by json. Fixes security flaw #25.

Breaks compatibility with prior versions.

As you mentioned in #25, json returns `unicode` object, so I just transform them back to `str` when using `.load`.
There is no need to do a similar thing for `.dumps` since it defaults to encoding with utf-8.