Replace pickle by json. Fixes security flaw #25.

[Rogdham]

Breaks compatibility with prior versions.

As you mentioned in #25, json returns unicode object, so I just transform them back to str when using .load.
There is no need to do a similar thing for .dumps since it defaults to encoding with utf-8.

[FredKSchott]

Great fix, thanks! Would love more info on the security flaw in question, but maybe in a week or two when most have upgraded to a newer version

[Rogdham]

Sure, I've almost finished writing a blog post about that, but as you said I will wait some time before releasing it ;-)

I will try to remember pinging you when I publish it.

[Rogdham]

@FredKSchott: I've just published the exploit: http://r.rogdham.net/21