Add url escaping to constants

Since these constants can be defined by the user (in wp-config.php or
elsewhere), their value cannot be completely trusted, so escaping them
is necessary.
Escape stylesheet urls

Urls need to be escaped, as the constant cannot be entirely trusted and
$stylesheet could conceivably be anything.
Merge remote branch 'upstream/master'
Merge pull request #11 from Automattic/master

Add escaping to constants in urls