Do not leak variables

All variable declarations should start with `var`, otherwise they leak out into the global scope. In strict mode, this generates an error.

Closes #36.