do not allow __proto__ as property/event name
5.5.5