escaped tag attributes

This fixes some possible security holes, where user-derived content is included in html tag attributes without being escaped.

I've been pretty cautious, and escaped nearly every attribute in the templates. There might be some that could have been left unescaped, but it seemed safer and easier to do them all.

I've tested the modified code on my localhost webclient, and it doesn't break anything obvious.

This resolves issue: https://github.com/buddycloud/webclient/issues/124

andy