Refactor shared code from pushState & replaceState into newState.
Modify historyManager:
- each history state is represented by a State object
- the State object is passed to all callbacks
    + historyManager.pushState(data, title, url, newStateHandler)
    + historyManager.replaceState(data, title, url, newStateHandler)
    + historyManager.start(data, title, url, newStateHandler, popStateHandler)
    + State#update(data, changedStateHandler)
- the above calls return Promises, which reject if the call cannot complete
    e.g. another state change handler is already executing
- historyManager.start() receives the (one and only) popstate handler
Evaluate @for scripts are all other scripts in <head> have executed.
Implement DOM.closest(el, selector)
Implement RequestNavigation handlers for frames and frameset.
This pseudo-event is triggered by 'click' events that bubble through
a hyperlink (<a href="...">) element.

Framesets handle the nav request by running a lookup() function to identify
the appropriate target frame and calling framer.navigate().
This is a refectoring of the previous behavior.

Frames can handle the nav request in the same way except calling framer.load()
which does not update the address-bar url (doesn't call history.pushState).
Implementing frame handlers required element userData
which is implemented with `nodeManager`.

If one frame handles the nav request it prevents ancestor frames
(and the frameset) from handling the event.

FIXME hasn't been tested on IE8, IE9
require_pushState