Update qs dependency

See https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking
Merge pull request #403 from saponifi3d/double_render_fix

Call render when a DOM element containing only data is passed in via the `data-render` attribute.
Merge pull request #386 from pdehaan/patch-1

Update qs dependency
Merge remote-tracking branch 'upstream/master' into change-master