Fixed UF-67 by making JGitFileSystemProvider not a singleton

This fix uncovered a pre-existing issue with AbstractIOService.startBatch() which is now
documented as UF-70.
Fixed a (recently introduced) XSS vulnerability in the login page