Fix XSS in select2 fields

Use select2's escapeMarkup function for our own formatter implementation.
Fix XSS in timelines select2 fields
Merge pull request #193 from opf/feature/rails3_fix_select2_xss

Fix XSS in select2 fields