respond-proxy.html has XSS issue

For example: http://yourcdn.com/respond-proxy.html?url=javascript:alert(19890611520);&css=http://yourcdn.com/test.css

Code: https://github.com/scottjehl/Respond/blob/master/cross-domain/respond-proxy.html#L90