[web] start a new message system based on id of message stored in session's data
instead of using __message as today, which is problematic (allow message injection).
Also we can have html in messages. Removed the __createdpath hack used to escape those
limitation.
The old system should still work though (and will probably for a while, though
we should progressivly move to the new system where it's possible).
Cleanup request paramaters handling on the way.