prototype pollution

Is this library intended for usage with user input (i.e. as PATCH in http server)?
In that case, maybe it would be good to point out (or fix) the possibility of prototype pollution, e.g.
```javascript
apply(a, JSON.parse('{ "__proto__": { "abc": 42 }}'))
```