Add rails_xss plugin for automated XSS protection

This is the default way under Rails 3. The idea is to make the Rails 3 upgrade easier by merging this in sooner rather than later, assuming of course it's good to go.

There are lots of tiny little fixes that had to be made to get this passing all the tests and for no obvious problems to be visible clicking through a running development instance.

There are also some ugly i18n hacks that I've tried to tidy up a little that were affected by the rails_xss plugin.