Update recommendation in documentation on bootstrapping to follow OWASP guidelines for preventing XSS attacks on web applications.

Preventing Cross Site Scripting attacks on Backbone applications was partially addressed in #1084 last year. 

However, the technique suggested in current documentation is still vulnerable to injections. 

Recently the Open Web Application Security Project (OWASP) updated its guidelines for bootstrapping application data in JSON, and I recommend that backbone.js' documentation follow suit. 

I'm attaching a pull request for updated documentation to this issue. 

---

Current documentation suggests writing initial collection data to a
SCRIPT element. The documentation suggests further escaping to prevent
injections from untrusted data. The best practice for this is to write
the JSON into a hidden div, read the JSON out as text, and use
JSON.parse to read it into the context.