Check user input in XML responses.

Fixes bug 1183884.

* swift/account/server.py: Escape account name in XML listings.

Change-Id: I7ba54631ed1349516132c00a53fae74f0b84ac37
Fix handling of DELETE obj reqs with old timestamp

The DELETE object REST API was creating tombstone files with old
timestamps, potentially filling up the disk, as well as sending
container updates.

Here we now make DELETEs with a request timestamp return a 409 (HTTP
Conflict) if a data file exists with a newer timestamp, only creating
tombstones if they have a newer timestamp.

The key fix is to actually read the timestamp metadata from an
existing tombstone file (thanks to Pete Zaitcev for catching this),
and then only create tombstone files with newer timestamps.

We also prevent PUT and POST operations using old timestamps as well.

Change-Id: I631957029d17c6578bca5779367df5144ba01fc9
Signed-off-by: Peter Portante <peter.portante@redhat.com>
Merge branch 'grizzly', remote-tracking branch 'upstream/stable/grizzly' into grizzly