Clean up lowercase duplications of request.GET/request.POST.
Fix validating uploads post-"storify" removal.

Refactoring out the old "storify" function and duplicated request data
params changed the semantics of file uploads. Uploads are now presented
as cgi.FieldStorage values to our validators, and need to be referenced
by their `.value` property to get the data.
toolbar: Convert inner frame to using iframes.
toolbar: Add sandbox attribute to prevent JS redirection.

Thanks to Mathias Karlsson for suggesting this change.
LESSify .nextprev styles.
Remove invisible numcolmargin reference in compact.