safer zero-copy semantics (fix #47)

Seems like this should be merged; the old state of affairs is too dangerous.