Small, medium priority security fixes

[georgelgeback]

Told Claude to search for any problems and these ones actually seemed bad enough to fix:

• Getting all users who hold a certain post now requires you to be a member
• Add formula escaping to csv export
• Fix bug which allowed html in stil_id to slip through sometimes (the frontend also escapes it, so it was likely not a big problem)
• Ads are not done yet, but fixed a bug where anyone could create an ad in somebody else's name

Created regression tests for all of the above except the ad fix, which didn't feel like it needed one. Ideally the tests would be in their respective files for whatever service we are testing, but we have no post tests, no tests of csv export and none for the stil-id serving nor doors.