Code is now executed inside a sandboxed iframe.

This means message passing hell.

* Moved most of the functionality out of jsh.js into evalFrame.html and
  InjectedScriptHost.js
* jsh-console.js is a "factory" now.