Remove the legacy code from xss() that handled objects.

It's a string validation and sanitisation library so this code does
not belong here. The same behaviour can be emulated with:

for (var key in obj) {
   obj[key] = sanitize(obj[key]).xss();
}

Closes #188, #189, #193
1.2.1