The ORM should skip updates in the InstrumentedList for deleted items.

This allows messages to be stashed in the session and displayed on a
following request. This will be pivotal in implementing the PRG
(post-redirect-get).

* Make the "Items" tab the default
* Drop the "Showing ..." text and add a count to the items tab
* Redirect to "Items" tab when creating a new list
* Add a new list item by ajax rather than refresh

Also fix clobber of password reset user ID's in config table, and fix
cleanup of client password reset tokens from config table.

Also fixup some layout issues in filter management