Replace PHP_SELF with SCRIPT_NAME in setup

Also apply htmlspecialchars() to the echo in setup/templates/findcore.php

Both changes address the Reflected XSS in findcore.php issue reported at http://www.securityfocus.com/archive/1/529372/2013-09-27/1 that is only exploitable in environments that handle the PATH_INFO variable defined in the CGI spec; see http://tools.ietf.org/html/rfc3875#section-4.1.5

(cherry picked from commit 0fcf9cd97a2bcff20d4f4f66abd43350f9e33e42)