Fix XSRF in login found by skipfish.
Prevent attacks with "/" after the script name.
Make sure timezone is valid before we try to set it.
Fix XSRF issue with week number and allow no week to be specified.