Various xss escaping fixes

These things keep popping up in obscure places. I hope we're getting close to finding them all!