Using javascript magic is potentially dangerous from within nbviewer

[mpacer]

If you go to this notebook from the IPython docs, you will see that it triggers two alerts. This seems inadvisable as it would be a opportunity for malicious notebooks to inject general javascript into viewers' browsers. Maybe, I'm overly worried, but it seems like we should write a preprocessor to make sure that this doesn't occur.

@rgbkrk @minrk

[rgbkrk]

We generally assume that nbviewer is an unsafe place, which is why/how Bokeh and other display themselves on the page.

[rgbkrk]

Long term view, I'd prefer all HTML and JS mimetype output to be iframed.

[kiwi0fruit]

@mpacer How bad is this for the one who views the notebook? (At the moment I'm investigating this use case for nbviewer)