Fix XSS issue

You could inject JS via the url callback:
/#noAccess?urlback="><script>alert(9)</script>
Show full database name in browser's tooltip

After PR #74 long database names are showed trimmed and it's hard
to guess what the full name is. Parsing URL with eyes isn't handy
since there are a lot of other information presents, urlescaping
harms readability while you need to quickly figure out where you
are.
Cleanup: testUtils.js - underscore is not needed
whitespace fixes
Url-encode document-ids properly

 - modify the helper to also urlencode on `%`

Closes COUCHDB-2342
Only show sidebar options that exist
add support for external link
Fix COUCHB-2171 noAccess page mixes 401 and 403 responses