Fixed XSS in snippets generator

Under certain circumstances, parts of the client-supplied URL path would
be used in the "canonical" <link>, and no HTML-encoding was applied to
secure this, causing a reflected XSS vulnerability.

I have not been able to reproduce the exploit on my test environment,
but I have verified it on another system.
A parser for more complex permission queries
Extended permission query syntax

Now supports combining permission checks with "and" and "or".
Front-end permission checks
Changed hard failure to warning for missing permission rules

(the dreaded "the permission X is not assigned to any roles" error)
Added inline documentation on permissions