Split server.go into server.go and query.go.
Let the query helper ensure that all string arguments are escaped.

Introduce a new type, identifier, to be used for strings that shall never be
escaped, similar to how html/template treats the HTML, JS, etc. types. The
query helper now expects printf style format and value arguments.
Improved error reporting in graph(): correctly report bad requests.
Make a graph's start and end times configurable.
Make a metric's graph's time-range configurable.