Taint env vars

This adds an extra layer of internal security for private/secure env vars: Secure vars will taint their value (string). Should any of these end up as an argument to `--display` in the compiled script then an exception will be raised. Of course this only prevents from the unlikely case that we screw up how we use secure vars internally, but I think this is a good thing to have in place.

Additionally this pull request also simplifies how we use env vars, `shellescape`s all builtin env vars (coming from request data and such), and add some extra coverage to env var specs.