Move 'query locations' table below query list in /queries

For large clusters, the query locations table can get long, and it's not
always that interesting. This patch moves it to the end of the page.

Change-Id: I0924a8df989ef5e174d99a05f73c6e7cc07e743f
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/5073
Reviewed-by: Alex Leblang <alex.leblang@cloudera.com>
Tested-by: jenkins
IMPALA-1444 Using both ldaps:// and --ldap_tls breaks LDAP auth

There are two ways to get TLS on the LDAP connection.  The first is to
use an ldaps:// URI. The second is to use an ldap:// URI, but then
issue a STARTTLS command to upgrade the insecure connection to a
secure connection.  This is what the -ldap_tls argument does.

Supplying both of these together doesn't make sense, and confuses the
LDAP server.  The fix is to simply ignore -ldap_tls when ldaps:// is
used.

Change-Id: Id9238c24324414d4d00090bb3e926f217a4be8aa
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/5075
Reviewed-by: Henry Robinson <henry@cloudera.com>
Tested-by: jenkins
Move block mgr initialization code outside of global lock.

We see high contention in BufferedBlockMgr::Create under concurrent workloads.
The issue is that the block mgr is shared across all fragments within a query
so there is a process wide lock to maintain the map of query ids to created block
mgrs. The code before this patch does the initialization of the block mgr with
the global lock held.

This patch moves does two things:
  - Move the initialization to hold only the block mgr lock and not the global lock.
  - Defer some initialization to first use: don't create the tmp files until the first
    spill.

Change-Id: If7a02df84acbd18a330bf8aed0e9a8226f8a2210
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/5068
Reviewed-by: Daniel Hecht <dhecht@cloudera.com>
Tested-by: jenkins
CDH-22184: Make sure web error messages are escaped for HTML

This patch moves error handling for the webserver to its own template,
which means it gets to take advantage of the escaping features that
templates have. The benefit is that if an error message includes
user-created content (which may be maliciously crafted), the webserver
escapes it and so it's unlikely to be executed by the client.

There are still ways to get unescaped HTML content, specifically by
requesting the JSON or 'raw' versions of a page. These pages are
returned with content-type 'text/plain', however, which means that
clients should not attempt to execute any scripts they contain.

Change-Id: I7d2e2f10748c6f27e110d7366ec1a8b54a44bc21
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/4775
Reviewed-by: Henry Robinson <henry@cloudera.com>
Tested-by: jenkins