SECURITY fix for arbitrary code execution

Plugins that still use loadtab.php can no longer use querystrings to
execute arbitrary functions. Use  your load_data function for this and
your own querystrings.
Some xss fixes

filtering $id reflection
Add sidebar-extra hook to load.php for plugins

Allows the addition of stuff under sidebar for plugin pages.
formatting