mod. move escape in user_request() into MySQLdb execution statement.
mod/sec. ensure that format_namespace escapes parameters from url output.
mod/sec. escaping user and project vars in query_method_deco decorator method.  escaped args in all query methods decorated with query_method_deco.
mod/sec: numeric casting and escaping of potential query output.