New hook for handling tokens before they are written

Proposed solution to #87.

Example usage:
```javascript
postscribe('#container', '<scr'+'ipt src="somescript.js"></scr'+'ipt>', {
    beforeTokenWrite : function(tok)
    {
        if (location.protocol !== 'https:' || !tok.tagName)
            return tok;
        
        if (tok.tagName == 'script' && tok.src && tok.src.indexOf('http:') === 0)
        {
            console.log('leaving script from insecure source unwritten');
            return null;
        }
        
        return tok;
    }
});
```
Why aren't we checking if the key is `booleanAttrs`? If there's a mix then we should still escape quotes in the non-boolean ones, right?