allow empty form action for self submitting forms (avoid ESAPI issues)

the ESAPI library (in this case the encodeForHTMLAttribute method) is
used to encode the <ft:form> action attribute, however it will affect
any URL variable which begins with a partial string that matches a HTML
entity name. e.g.

/some/content?page=1&order=asc
will become (after encoding):
/some/content?page=1&or;der=asc

.. because "&or" is being encoded into the HTML entity "&or;".
Pre-encoding the ampersand in the URL string does not fix this.

For now, removing the default value of attributes.action will avoid this
issue for all forms that submit to themselves, however where the action
attribute is supplied to <ft:form> developers will need to be aware that
URL variable names matter when using the ESAPI methods. Painful but
seemingly necessary.

http://lists.owasp.org/pipermail/esapi-user/2011-October/000911.html
tidy up string evaluation and old commented code block