Security enhancements.

* Require only "activeTab" permission, now that it's available in Chrome.

* Do not fill forms that send information to a domain different
  from originating page.

  Motivated by
  http://isecpartners.github.io/whitepapers/passwords/2013/11/05/Browser-Extension-Password-Managers.html

* Properly escape username passed to form filling script.