Several security enhancements.

* Require HTMLPurifier >= 4.6.0

* Forbid using resources (ie images) in formatted user content (like
  comments, loadout descriptions, etc.). This helps mitigate some CSRF
  attacks and also prevents leaking private URIs via Referers.

* Munge external URIs in formatted user content. This also prevents
  Referer leakage, and also makes spamming links less effective for
  bad guys.

* Use a meta name=referrer set to origin for the few browsers that
  support it. This is a last resort to avoid Referer leakage.