[#5596] Replaced most occurances of HTMLField with safer DisplayOnlyWidget

Signed-off-by: Cory Johns <johnsca@geek.net>
[#5596] Added safer implementation of LinkField

Signed-off-by: Cory Johns <johnsca@geek.net>
[#5596] Removed remaining references to HTMLField and LinkField

Signed-off-by: Cory Johns <johnsca@geek.net>
[#5596] Fixed tests failing due to missing fields in rendered form

A couple of missed url fields, and moving _id to fields from
hidden_fields due to from_python ignoring anything in hidden_fields

Signed-off-by: Cory Johns <johnsca@geek.net>
[#5596] Fixed missed unsafe interpolation

Signed-off-by: Cory Johns <johnsca@geek.net>