Escape the unit value provided to number_to_currency

Fixes CVE-2013-6415.

Previously the values were trusted blindly allowing for potential XSS attacks.

This is different from the original upstream patch for 3.x in that return values
from other number helper methods are not marked as html_safe, so the html
escaping always applies. This requires applications to explicitly set .html_safe
on unit strings and number separators when calling number_to_currency.
Only escape value if present
Merge pull request #31 from github/currency-security-fix

CVE-2013-6415: Escape the unit value provided to number_to_currency