none of the requests & forms controllers used escaping so I escaped the variables exclusively in the templates
Prevent XSS in various user-related templates (OpenID, password reset, manage
user, user addresses, admin management of user API keys). Also fix places where
the redirect URL used by OpenID methods could point to a site external to
Galaxy.
Fix various bugs and security (XSS and other) issues with user address handling.
Escape input values in new user address form.
Don't escape full strings containing desired html.
Bump NO_OUTPUT_TIMEOUT to 60m; Bjoern said it's causing issues w/ some tools for being too short.
Pep8 tool_shed/util/basic_util
Fix size_string; this would have thrown an exception on being called due to an unimported 'util'.
DatasetMatcher should check to see if hda is of the correct format before attempting to filter on e.g. metadata attributes (that may not exist for a non-expected format).
Merged in martenson/galaxy-central-marten/mako_escape_requests (pull request #579)

[next-stable] escaping of the templates in the 'requests' and 'forms' sections
Specify the third argument for HdaImplicitMatch.
Merge stable changes to next-stable.
Merge next-stable to default.