browser, composer: escape target/queryString template variables

This fixes:
	* XSS
		e.g. ?target="/><script>...</script><!--
	* Targets with special characters, like double quotes
		e.g. ?target=summarize(foo.bar,"1hr")