Correctly encode confirm handlers

With encode set to false the onclick handler will be sent through
htmlspecialchars() regardless, making links and postLinks work again.