First attempt a public import on document.
Add missing file to go with flash message css.
Protect against url insertion attack

An attacker could insert special characters into the document id in an attempt
to make us pass them to google. Not that he would gain anything, but it pays
to be careful.