There wasn't actually a vulnerability AFAIC because hypha names are
passed through CanonicalName which strips those characters, but fix it
anyway for the sake of correctness.
Starring:
* Broken error localization for now (got in the way)
* The title for error pages is the same for all errors (who cares anyway)
* New bugs
* The brand new /rename/ handler