[web] start a new message system based on id of message stored in session's data instead of using __message as today, which is problematic (allow message injection). Also we can have html in messages. Removed the __createdpath hack used to escape those limitation. The old system should still work though (and will probably for a while, though we should progressivly move to the new system where it's possible). Cleanup request paramaters handling on the way.

[notification] fix dumb name error in hijack user

[dbapi] return default argument instead of None when no connection set yet

[cleanup selectors] use authenticated_user, check for form params instead of handling potential key error on missing params

[db backup] fix name error in backup_to_file: we've to pass .confirm all along the chain as for restore

[cleanup] use iteritems