Escape output to prevent XSS

This should prevent XSS from happening on feed titles. Currently, renaming a feed to ```<script>alert('hi');</script>``` will cause the code to be evaluated in page. Supposedly, this will fix that.