Security update: Escape HTML chars in heading