support for using WMTS servers as custom overlays (thx dimizu!); custom overlays and custom basemaps with & and {} chars in URLs were broken; potential XSS security issue on fullscreen maps