Minified jQuery contains a source mapping hint that will result in a 404
in Chrome. I removed the hint for now. A better solution (eg. fixing the
mapping URL) should be found.

The plugin manager echos raw URLs in error messages, this could allow to
construct an XSS attack. However the affected form is CSRF protected,
so an attacker would require another XSS vulnerability to get the needed token,
rendering this attack unneeded. So this should not be exploitable.

compatibility with php 5.2.x (str_getcsv() is only available in
php 5.3+ and is used by user manager import feature.

- don't die at end of _export()
- internal classs wrapper method for is_uploaded_file() to allow
  overriding for use under cli & without having to upload a file