browser, composer: escape target/queryString template variables

See PR #457 for details (esp. comment https://github.com/graphite-project/graphite-web/pull/457#issuecomment-58926028)
Move TIME_ZONE default definition to the top
Bulk-fetch metrics from remote hosts
Remove print statements from patch
PR Feedback + comments
Merge pull request #1006 from gwaldo/0.9.x

Backport: Docs: Python Dev Headers needed for custom install location
Merge pull request #1003 from deniszh/0.9.x_xss

browser, composer: escape target/queryString template variables
Merge pull request #1010 from bmhatfield/09x/cluster-render-performance

Bulk-fetch metrics from remote hosts
Perform all remote fetches in parallel
Add comments and improve remote-fetch algorithm
Stabilize the result ordering by sorting the series by name
Comment about result ordering
Fixing release notes for upcoming 0.9.13 release
Adding latest commit to release notes
Merge pull request #1050 from deniszh/0.9.x_releasenotes

Fixing release notes for upcoming 0.9.13 release
Adding pytz test for check_dependencies.py

Fixing issue #1019
Adding pytz as dependency into install documentation
Merge pull request #1061 from deniszh/0.9.x_pytz

0.9.x pytz
Merge pull request #1026 from bmhatfield/0.9.x-threading

Perform all remote fetches in parallel
Adding #1026 to 0.9.13 release notes