Prevent XSS in unknown tool display, update to actually use show_error_message instead of replying with plain text.
Another instance of tool_id reflected xss (in data_source_redirect).
Referer-in-okmessage reflective xss fix
Referer-in-logout reflective xss fix.
Remove unused cloud/run.mako; all functionality is rolled into cloud/index.
Don't trust user email rendered into page unescaped for Raven.
Catch ValueError and actually log it instead of blowing up w/ invalid dataset_id.  Raise httpexception.
Fix search to work for at least datasets, hdas, etc.
Disable search interface for right now -- I made it not broken in the previous commit, but nobody should be using this yet.
One more place we shouldn't trust user_email.
Merged in dannon/galaxy-central/stable (pull request #596)

[STABLE] Grafts of next-stable commits for security release.
Merge stable.
Merge next-stable.