PEP 8
Fix #1042

We had an XSS vulnerability where specially-crafted URLs could allow
remote JavaScript execution in Firefox, etc. (Chrome protects against
this flaw). The problem is that URLs including a double quote in the
path would break out of html attribute context in the sign in template
include, where they were included as the path to redirect back to after
sign in. The solution here is to base64-encode these paths before
transporting them through the oauth provider.
Bump version to 9.0.11
Bump version to 9.0.11-dev