Merge pull request #201 from SysTheron/500ErrorPage

500 Error Page for Debug mode
Allow system-wide configuration of instance member list sorting
Fix url tests after 1fa0e9415323b70da8143b99e32ccd04cdb223dc
Sanitize HTML after markdown rendering
Fix mdx_showmore markdown extension after HTML sanitization
Merge commit 'nidico/sanitize-html^' into develop
Forbid <object> in cleaner.
Also add more tests, and make sure tests run on Python 2.6
Do not allow HTML input

As of f1632cca1160eae2f6e3b2612e26aada5d203760 (and before 13ab01a4488e4e2f8d396e913fee00bdb46adf88), instance administrators can inject arbitrary HTML into an application.

If relative_urls is on, this allows instance administrators to trivially execute JavaScript in the installation's origin.
But even if it's off, instance administrators can trivially:

 * Steal users' session cookies (And vote as them in other instances!)
 * Out-right ask users for their passwords.
 * Switch out links to other parts of the UI

http://sectest.adhocracy.de/ demonstrates this (try clicking one of the navigation links).

Therefore, we should forbid HTML in instance and milestone texts. This commit does exactly that.
Make HTML rendering conditional upon an installation-wide configuration option
Merge pull request #202 from phihag/request_logger

Log requests
Revert "Do not allow HTML input"

This reverts commit dfa8f5e3c10f00e28af1adede2054d8d0a1cbbe9.

Conflicts:
	adhocracy/lib/text/render.py
update docs to reflect #137
Commit current pot
Restore default safe_mode argument in markdown_to_plain_text
Transplant another XSS fix from hhu-theme
See https://github.com/hhucn/adhocracy.hhu_theme/issues/125 for details
Remove iframe border

Due to the restricted user html handling in
dfa8f5e3c10f00e28af1adede2054d8d0a1cbbe9, the non-html5-compliant
`frameborder="0"` attribute, which is part of the default youtube and
other embed codes, isn't permitted by the lxml html cleaner.

Therefore iframe borders are now hidden in the default css, as nobody
wants that anyway.
Helper function to determine whether HTML is allowed
Only show HTML notice if HTML is allowed
Fix DetachedInstanceError after StatusCodeRedirect

In certain cases, e.g. after an exception has been thrown, the database
session may be detached, but database objects managed by the orm are
still refered to from the same thread.

Such objects can be merged with the new db session, as described in
http://stackoverflow.com/a/9705458/201743

This is done with `c.user` which is re-retrieved from repoze.who after a
StatusCodeRedirect.

This fixes what ade22d799ebe894b1f7a9fbc3a5685e6aceca4e7 works around.

See also discussion on: https://bitbucket.org/phihag/hhu-
adhocracy/issue/168/error-handler-causes-is-not-bound-to-a
Avoid UnmappedInstanceError if c.user is None

Addendum to afa02732f672af01ef33dbaa1520beabdf577256