correctness fixes and formatting changes

  * api responds with text/plain content-type type now
  * html encode where necessary (I think that's all spots)
  * more replacements of print() to be 'print'
  * turn off autocomplete in registration form
  * sql statements are now one big string
  * sql statements that had parameters inline are now parameterised
  * set html5 doctype