more code clean up + security patch in cms_edit.php

cms_edit.php now verifies file is on whitelist as well, changed
editable.txt to editables.txt