browser, composer: escape target/queryString template variables

See PR #457 for details (esp. comment https://github.com/graphite-project/graphite-web/pull/457#issuecomment-58926028)
Move TIME_ZONE default definition to the top
Bulk-fetch metrics from remote hosts
Remove print statements from patch
PR Feedback + comments
Merge pull request #1006 from gwaldo/0.9.x

Backport: Docs: Python Dev Headers needed for custom install location
Merge pull request #1003 from deniszh/0.9.x_xss

browser, composer: escape target/queryString template variables
Merge pull request #1010 from bmhatfield/09x/cluster-render-performance

Bulk-fetch metrics from remote hosts
Fixing release notes for upcoming 0.9.13 release
Adding latest commit to release notes
Merge pull request #1050 from deniszh/0.9.x_releasenotes

Fixing release notes for upcoming 0.9.13 release