Don't treat gettext's output as HTML: JS edition

We don't trust gettext's output, so we can't treat its output as raw HTML.
HTTPSify emailed links containing secret tokens

Thanks to @edent for the report!
Guard against trying the pagecache twice in one request
Make sure the same request key is used for pagecache gets and sets

Some parts of the key can change between `pre()` and `post()`, most
commonly due to an endpoint forcing a particular `c.extension` or
`c.render_style`.

In particular, endpoints that used `api/json_validate` were affected
when requested with no extension. They would never hit the page cache.