Properly escape parameters to Dwoo "a" blocks.

I'd expect to use local variables without HTML escaping, and have the Dwoo {a} block escape them for me. But it doesn't.

This can allow XSS injection in some cases, e.g. where URL parameters are copied back into the output, and breaks XHTML validation as well if {a} blocks are used.