fixed security issue that allowed <script> tags in. oops.
use URL if the feed doesn't provide a title.