The error message when a non-existant editor was tried to load wasn't
escaped correctly, allowing to introduce arbitrary JavaScript to the
output, leading to a XSS vulnerability.

Note: the reported second XCRF vulnerability is the same bug, the xploit
code simply uses JavaScript to extract a valid CSRF token from the site

https://github.com/splitbrain/dokuwiki/pull/96#issuecomment-5195756

There's still more that I'd like to moved out. bootstrap should not
contain any logic but only call the appropriate functions for setup the
test environment.

This should make it much easier to do integration tests based on the new
TestRequest utility.

This allows us to distribute plugins that are disabled by default. We'll
may want to do that for a special unit test plugin

fixes passing null to event hook registration

using the awesome httpbin.org service

We had a lot of options lumped together under "Advanced Settings". I
introduced two more categories and move a few options to other existing
categories.
I also reordered the appropriate entries in the source files to make it
easier to find stuff when extending the options.