Fix (hopefully all) XSSes in old CGI-based code. Fixes bug 846291.

We used to pointlessly HTML-escape the query when returning search results as JSON. Stopped that.