[FIX] double html escaping in qweb
[FIX] website.image_url() access rights