Partial security - data url whitelisting

* Added vg.config.domainWhitelist = ['domain',...]
If this config value is set, data urls will only work if the domain
or a subdomain of that URL is listed.

* Added a non-functional vg.config.trustData
This value should be examined when performing eval()-like operations,
e.g. test='alert(document.cookie)'