Only mark email_subject_request as HTML safe when used in email subject.

It's also used in the web interface and needs to be escaped there.
Remove obsolete 'require' statement
Enforce a lifetime on session cookies

Problem described in http://seclists.org/fulldisclosure/2013/Sep/145

Pattern taken from https://www.coffeepowered.net/2013/09/26/rails-session-cookies/
Refactor the application of masks and censor rules to messages.

Seems more logical to make this one method that figures out what to do
based on file type. Plus, incoming message does so many things, it
seemed like having these related methods be separate would make them
easier to read and understand. Also, email, mobile and login
substitution texts weren't being translated. Finally, I think passing
the censor rules and masks as arguments is a first step in some more
decoupling of models.
Merge branch 'misc-fixes' into rails-3-develop
Merge branch 'rails-3-develop' of ssh://git.mysociety.org/data/git/public/alaveteli into rails-3-develop