fixing DOM based xss

Attacker can steal cookies, run scripts from a site with docson - generated docs.

Sample link:
`http://lbovet.github.io/docson/index.html#<img src=y onerror=prompt(document.domain)>`