update: fix crash on bare update when directaccess is enabled 'rev' may be None. An empty 'rev' string shouldn't also be passed to unhidehashlikerevs().

templater: make sure expression is terminated by '}' This can't be ensured by the tokenize() generator since the parser stop consuming tokens once it reached an end of an operation. Spotted by Matt Harbison.