check tpl files inside active themes first and use that if exists
improve security on tpl_apply()
add new defines and rename some defines to use _
expand tpl_apply() to check first from plugin, then from themes and finally from common place in themes
rename tpl_apply_core() to _tpl_apply() to indicate its private function