Minor security fixes.
Cleaned up backtraces so they don't show the full path.
Stopped using PHP_SELF for the script name to prevent some attacks
on the URL, but still displays the calendar in those situations
for people with web server redirects that do funny things.