Add leading slash to cordova_plugins.json in plugin loader

This fixes script injection on pages which are not at the application root.

lib/scripts/plugin_loader.js

@@ -114,7 +114,7 @@
         finishPluginLoading();
     };
     try { // we commented we were going to try, so let us actually try and catch
-        xhr.open('GET', 'cordova_plugins.json', true); // Async
+        xhr.open('GET', '/cordova_plugins.json', true); // Async
         xhr.send();
     } catch(err){
         finishPluginLoading();