Disallow directly outputting script/link tags

Fixes #35