The original use of the renderer was for benchmarking,
to know the time used exclusively for parsing. But setting
NULL callbacks actually disabled parsing. No-op callbacks
should be used instead.
Even with these flags active, injections and XSS are still easily possible.
Providing full attribute checking, HTML validation, ... is out of the
scope of Hoedown, therefore this "security" features only create
a false sense of security rather than actually providing it.
It's redundant. A zero `nesting_level` already means "disable TOC"
and a nonzero `nesting_level` enables it.
Having a TOC flag only complicates the code unnecessarily.
