same_domain_required decorator

checking that some form POSTs are coming from the servers domain (im
sure this needs testing)
input escaping

trying to integrate jinja2 autoescape, but not there yet.