The item_name part of the URL is not always escaped correctly, see:
TODO: do a global review for such stuff
escape metadata to avoid XSS / html / js injection via item_name, comment or other user-settable metadata (should fix #3 )
Fixed https://bitbucket.org/marchael/moin-2.0/issue/3/dicts-are-bad-for-sorting Fixes #3.
ignore comment 4, was caused by pull from another repo.