Merge changes back to upstream

* Since `admin_enqueue_scripts` and `wp_enqueue_scripts` only run on the back and front-end respectively, we don't need to check whether or not we're in the admin for those.
* Adding some escaping in output HTML
* We should be extra careful about what we're outputting in Javascript