Make Blaze refuse to render javascript: URLs.

Call UI._allowJavascriptUrls() to enable them again. In the future, we
should have a per-element way to enable this, not a global
configuration, and maybe someday even a similar feature for other
policies (like enabling or disabling inline event handlers).
Remove unnecessary DOM update in test.
Only update URL attribute values after checking protocol.
Avoid relying on HTMLAnchorElement.protocol; browser support not clear.

Also avoid url.format, since we don't actually need server-side URL
normalization yet and it's not clear what, if any, normalization
url.format does.
Add History entry for javascript: hrefs
Merge branch 'href-attr-handler' into devel