Upgrade `marked` dependency to 0.3.9
Upgrade `marked` dependency to 0.3.9

avoid CVE-2017-1000427
(though the CVE is for an XSS vuln, and untrusted bml input
is always a bad idea anyways since it supports eval blocks)

ajyoon/bml,ajyoon/bml,ajyoon/bml