[web] stop accepting the magic __message form parameter
This has been deprecated for a while, and replaced by _cwmsgid, which
doesn't allow arbitrary content.
option_group_changed('port', 'main', 'web')
option_group_changed('query-log-file', 'main', 'web')
option_group_changed('profile', 'main', 'web')
option_group_changed('max-post-length', 'main', 'web')