Replace all setTimeout strings with functions

This fixes a cross-site scripting vulnerability.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>

js/feedlist.js

@@ -198,7 +198,7 @@ function feedlist_init() {
 		loading_set_progress(50);
 
 		document.onkeydown = hotkey_handler;
-		setTimeout("hotkey_prefix_timeout()", 5*1000);
+		setTimeout(hotkey_prefix_timeout, 5*1000);
 
 		if (!getActiveFeedId()) {
 			viewfeed({feed: -3});