Merge pull request #23 from burntout/master

Changed to use AES-CBC with HMAC-SHA1, rather than plain Blowfish ECB for authenticated encryption and associated data ( encrypt then mac ). Server never records the encryption keys now, the url contains the
decryption keys, unless a user passphrase is used. User passphrases are passed through PBKDF2 for improved entropy. Duress key provides lorem ipsum text.
formatting
return zlib compression/decompression and change faq and security pages to reflect Blowfish -> AES change
add updates regarding the new url format
add javascript logic to hide the qr code by default to prevent over-the-shoulder-scanning
add logic for creating data dir if it does not exist
formatting and s/uri_rand/uri/g
some code cleanup
template formatting updates
update security.html to reflect the pbkdf security
fix typo
remove redundant text about creating a new note