more restricted Lua runtime

The only Python object accessible from Lua is a current Splash instance;
allowed attributes are limited by a whitelist.