The lxml.etree.fromstring() function use the default XML parser, which resolves
external entities because XML handling defaults in Python sucks. There is no
need for such dangerous misfeatures in calibre-web, so let's disable it.
A user able to upload epub/fb2 could add something like this to the file:
```xml
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<container><rootfiles><rootfile full-path="&xxe;"/></rootfiles></container>
```
and obtain the content of the `/etc/passwd` file, which is bad™.
Handling of missing tags in fb import
naming of path is more imitating calibre (replacement of special characters, "pinyining" of author names if unidecode is available )
Sorting of authors (similar to calibre for jr./sr./I..IV endings)
bugfix pathseparator on windows and linux during upload
bugfix os.rename for authordir
publishing date on detailview is formated according to slected locale
filename on downloading from web ui is now correct displayed
added ids to html for testing
- added most downloaded section in opds view
- imporved fb2 upload, correct handling of missing elements
- author sort is set on editing and uploading files
- Encoding stuff on uploading files
