aura:include exports attribute should only allow javascript identifier
and not any other javascript for security

@bug W-2328649@
Merging origin/bob/master-pending/include-exports-check into master