detect if title in tooltip is text or html. if text - use text method to prevent xss.

all add a few notes to js readme about updated event

js/bootstrap-tooltip.js

@@ -155,9 +155,21 @@
       }
     }
 
+  , isHTML: function( text ) {
+      // html string detection logic adapted from jQuery
+      return typeof text != 'string'
+        || ( text.charAt(0) === "<"
+          && text.charAt( text.length - 1 ) === ">"
+          && text.length >= 3
+        ) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text)
+    }
+
   , setContent: function () {
       var $tip = this.tip()
-      $tip.find('.tooltip-inner').html(this.getTitle())
+        , title = this.getTitle()
+        , isHTML = this.isHTML(title)
+
+      $tip.find('.tooltip-inner')[isHTML ? 'html' : 'text'](title)
       $tip.removeClass('fade in top bottom left right')
     }