Replace TinyMCE 4.2.8 with a small local editor.

TinyMCE 4.2.8 has known XSS bugs. publish/editor.js has the same toolbar
and writes the same HTML. The textarea still posts the story.

publish/editor.inc.php

@@ -0,0 +1,15 @@
+<link rel="stylesheet" type="text/css" href="../publish/editor.css" />
+<script type="text/javascript" src="../publish/utilities.js"></script>
+<script type="text/javascript" src="../publish/editor.js"></script>
+<script type="text/javascript">
+  var storyEditor = null;
+  document.addEventListener('DOMContentLoaded', function () {
+    var story = document.getElementById('story');
+    if (!story)
+      return;
+    storyEditor = XxxEditor.attach(story);
+    // Count words as the story changes
+    story.addEventListener('input', updateWordCount);
+    updateWordCount();
+  });
+</script>