Use object with null prototype for various app properties

`app.cache`, `app.engines`, and `app.settings` are now created with
`Object.create(null)` instead of `{}`.

This also adds a test that `app.locals` is created the same way.

lib/application.js

@@ -54,9 +54,9 @@ var trustProxyDefaultSymbol = '@@symbol:trust_proxy_default';
 app.init = function init() {
   var router = null;
 
-  this.cache = {};
-  this.engines = {};
-  this.settings = {};
+  this.cache = Object.create(null);
+  this.engines = Object.create(null);
+  this.settings = Object.create(null);
 
   this.defaultConfiguration();
 

test/app.locals.js

@@ -1,16 +1,22 @@
 
+var assert = require('assert');
 var express = require('../')
 
 describe('app', function(){
   describe('.locals(obj)', function(){
     it('should merge locals', function(){
       var app = express();
-      Object.keys(app.locals).should.eql(['settings']);
+      assert.deepStrictEqual(Object.keys(app.locals), ['settings']);
       app.locals.user = 'tobi';
       app.locals.age = 2;
-      Object.keys(app.locals).should.eql(['settings', 'user', 'age']);
-      app.locals.user.should.equal('tobi');
-      app.locals.age.should.equal(2);
+      assert.deepStrictEqual(Object.keys(app.locals), ['settings', 'user', 'age']);
+      assert.strictEqual(app.locals.user, 'tobi');
+      assert.strictEqual(app.locals.age, 2);
+    })
+
+    it('is an object with no prototype', function(){
+      var app = express();
+      assert.strictEqual(Object.getPrototypeOf(app.locals), null);
     })
   })
 
@@ -19,8 +25,8 @@ describe('app', function(){
       var app = express();
       app.set('title', 'House of Manny');
       var obj = app.locals.settings;
-      obj.should.have.property('env', 'test');
-      obj.should.have.property('title', 'House of Manny');
+      assert.strictEqual(obj.env, 'test');
+      assert.strictEqual(obj.title, 'House of Manny');
     })
   })
 })