Security fix default user permissions

Default user permissions should not include all user attributes. We now
limit this to the username, realname and some further attributes
depending on the schema. Note that we no longer include the email
addresses, depending on your installation you may want to further
restrict this or add some attributes like ``address`` and
``alternate_addresses``.
Security non-standard html content as html

Attached html files are not shipped as text/html by default, unless
``allow_html_file`` is specified in the configuration.  Unfortunately
some browsers want to be helpful and render other non-standard content
types as html. We now change this to application/octet-stream whenever
'html' is contained in the string (case insensitive). Thanks to Kay
Hayen for reporting and helping debug this.