fixes bug 950385 - use psycopg's IN operator serializer

No string variables called something like `sql` should contain ANY parameter data. Hopefully this fixes all the occasions I could find with grep. 

@AdrianGaudebert r? cc @rhelmer