is legit HTML4. (C650)

  (in order to enable REMOTE_USER mode) also opens the monitor to any
  user connecting through localhost.

Fixed a bug which allowed unauthorized options to be displayed when adding a Folder. Now you only see
options to add an index_document and/or a user folder if you have adequate permissions.

NameError in manage_edit.

other strangosities.

argument is "self" to prevent things like hijacking external methods.

into themselves or their subobjects.

cloned requests do not leak.

duplicated code. The resolve_url of the REQUEST now correctly avoids aborting
the current transaction if an error occurs, so we just use that.

called without necessarily aborting the current transaction. This is
required by things like the resolve_url machinery, where there is a
need to call the exception() method to get a meaningful error. The
resolve_url method in HTTPRequest.Request has been changed to take
advantage of this. The existing semantics of RESPONSE.exception()
are unchanged - it will automatically abort just as it did before
unless you pass the keyword arg abort=0 when calling the method.

during resolve_url caused the exception method of the (cloned) response
object to be called. This mean that as soon as an error occurred during
resolve_url, the transaction would be aborted and things got extremely
weird since objects that had been uncataloged would suddenly be back
(due to the abort).

and that's too late to actually abort. abort is called in a normal
abort and is caled before commit, so it's the one that really matters.

images/files that use file-upload.  This makes it easier to use small
images with SQL methods.

Fixed a HTTP request bug which prevented ZPublisher.Client from being able to upload files to ZServer.