refs #3813 escape html title attribute to avoid possible XSS