src: split common.js into closures.js and static.js

These are included into target files directly, instead of by later calling a
function.
This results in better javascript minification, because in previously used
inclusion method, the variables were in object properties and could not
be minified.
check input headers for forbidden only on node

Browsers already throw in setRequestHeader.
play some code golf
readme.markdown: Error Conditions: document the "abort" error
change API - add argument cb