Fixes XSS vulnerability in the translate helper method

There is a security vulnerability in the translate helper when using
the rails_xss plugin where translation string with a name ending in
'html' are considered HTML safe. What happens is interpolated input
is not escaped, allowing "javascript:" or "data:" to be injected
into the "href" attribute.

It is based off of the 3.0 patch, however I'm not quite sure how to
deal with `keys` as an Array (since that is deprecated in 3.0). So
I've aired on the safer side and chosen to make all options
html-safe.