Bug 1090468: Move transition.txt to original url.

This will work for now. Was going to serve from Django but that turns out to be a pain as I didn't want the language URL component but the rest of "/security" does. Refactoring how URL locales work is a task we need to tackle before we move off of apache though.
Escape the period in ```transaction.txt```?