- SimpleTree.py:  CGI escapes (merged from 2.6 / 2.7 audit).

  - Tree.py:  prevent DoS agains tree state cookie decompression (merged
    from 2.6 / 2.7 audit).