v0.1.13

Read the NODE_ENV aliases when choosing the cache mode

auto means never re-read a template in production and watch mtimes
everywhere else. With NODE_ENV=prod read verbatim it answered 'not
production': every render stats the file, and a template edited in place on
a live box is picked up — the thing never exists to prevent.

Say plainly that a template is code, not input

Expressions are evaluated as JavaScript by design, at the same trust level
as the application's own source. Rendering a template whose TEXT came from a
user is remote code execution; user-supplied DATA is a different matter and
stays escaped. Stated at both eval sites and in the README.

---

Changes since v0.1.12.