Reviewed Security In Piwik

Related to #22

I'm opening this as a PR because it depends on #34 to be merged (else code blocks will not work).

Not many changes but the diff seems to be a bit messed up.

Regarding [Preventing Direct Access](http://developer.piwik.org/guides/security-in-piwik#preventing-direct-access), is that common that plugins provide files that execute something? Because if that's not common/shoudn't happen, then I'd rather replace that part with something like this:

> All the PHP code provided in plugins should declare PHP classes (or functions or constants). Running that code should have no side effect (e.g. should not execute anything).

E.g. in [PSR-1](http://www.php-fig.org/psr/psr-1/) there's this rule:

> Files SHOULD either declare symbols (classes, functions, constants, etc.) or cause side-effects (e.g. generate output, change .ini settings, etc.) but SHOULD NOT do both.

I'd say code causing side-effect should not exist in plugins. Does that makes sense?
TODO can be removed?