Fix a security vulnerability: eval used in quoting display name

This use of eval allows arbitrary remote code execution on
parsing of a maliciously formed email.

Two tests are updated to match the behaviour of the new
code to return the display name - these introduce extra
escaping, so should be innocous.
Merge branch 'master' into croatia