HtmlEncode design mode header text

Related to issue #362. An injected xss code in the title tag is rendered without escaping in edit & delete.