option to escape html in title and message

add an option to escape html in title and message, to prevent message like `<script>alert('hey');</script>` get passed.