Prevent XSS on actionVar in header.tpl

The smarty template was reflecting the $_GET['a'] parameter without converting htmlspecialchars (was only using strip_tags)