Fix forIn iteration in IE8

Fixes #160

This fixes the `object/forIn` iteration in IE8. Previously it included the `constructor` property in the iteration, which is different from other browsers. This is rather complicated how it does it, but the comments should explain how it works.

Note that this is based on #161, will rebase once that (or equivalent fix for IE8) is merged.