Security checklist

[iherman]

This is a first round on https://blog.risingstack.com/node-js-security-checklist/, see also issue #16 (comment)

[iherman]

@tripu I have added some checks on URL-s, inspired by a script done by Bratt Smith (and added to one of my Python based CGI scripts): http://dev.w3.org/2004/PythonLib-IH/checkremote.py.

It does not reproduce the whole thing; to be honest I did not follow all the details of what he did, but I believe I did what is really of importance here. See the additional comments in the code (check_url function in io.js). I also added checks to be sure that what is returned for a fetch is of the type that one expects (plain text or JSON, respectively). Again, the changes are in io.js

[tripu]

Your changes look mostly good to me, so let's merge this one. I'll have to come back with help for some of the few questions still open, but I think we're almost there.