1. Added code to sanitize URLS prior to entry. Using JSGI middleware, we
add a "sanitize" requirement in webapp.js, invoking a function before
things are passed on to static, params, and route.

Sanitize will call convChars() to properly escape all HTML chars in
the URL before passing forward.

Added utils.js to hold convChars(), for use both in sanitize and in
widgets.js.

2. Added a "notfound.mustache" template for handling 404 errors.

3. added a final "/*" route to webapp.js, routing to the 404 page if
no other route resolves.
forgot widgets.js in previous commit.