Fix #1902 "Controls example shows invalid characters"

- we were forcing US-ASCII when no charset was provided
- now using more reasonable defaults
- Connection now tries to guess mediatype for oxf: and file:
- don't output application/xml by default in replace="all"
- sanitize SubmitResponseEvent a bit
- a few more details