theme config file can't be reached if theme_path doesn't begins with '/' in config.yml
rather trim()
Security fix: HTML-encode translation parameters
Fixed an XSS vuln in backend

Content type names are strings, not HTML, and should never be output
unencoded.
Another XSS leak fixed.
Fixed: was html-encoding the wrong argument.

I, too, need more coffee.
Fixed: XSS in content edit title
Merge pull request #1039 from rixbeck/master

theme config file can't be reached if theme_path doesn't begins with '/'...