bugs: add link to python script

and there's still no way to self-link urls.
remove original default $jsonfields_orig_headers, $jsonfields_top

They are now in default_config.pl and (for ml2json) never used here.
update api docs
assert identify value format (security)

not requiring md5 format here as this may change in the future.
fix passing mboxpath

(hu, did I not finish this?)
add mboxpath field to JSON