Don’t extend `String.prototype`

By using private functions instead, security issues with hacky workarounds like #52 are avoided. It also ensures that other scripts that rely on the native ES6 `String.prototype.{starts,ends}With` behavior won’t break the moment someone adds CSRFGuard to the page.