fix iq spoofing

Save 'to' attribute when sending iqs along with 'id' and check against
'from' when receiving and handling reply.

Addresses issues discussed at http://mail.jabber.org/pipermail/jdev/2014-January/089831.html

*untested*