browser, composer: escape target/queryString template variables

See PR #457 for details (esp. comment https://github.com/graphite-project/graphite-web/pull/457#issuecomment-58926028)
adding note that the Python Development Headers are required for installing Carbon to a custom location
python dev headers are required for pip installation.  Correcting the note and moving to earlier in the page.
Bulk-fetch metrics from remote hosts
Remove print statements from patch
PR Feedback + comments
Merge pull request #1006 from gwaldo/0.9.x

Backport: Docs: Python Dev Headers needed for custom install location
Merge pull request #1003 from deniszh/0.9.x_xss

browser, composer: escape target/queryString template variables
Merge pull request #1010 from bmhatfield/09x/cluster-render-performance

Bulk-fetch metrics from remote hosts