Always escape the URL echoed by header_image(). fixes #23664.

git-svn-id: http://core.svn.wordpress.org/trunk@23633 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When adding a new user in the admin, strip slashes from the password sent to the user by email. props hakre for initial patch. fixes #17018.

git-svn-id: http://core.svn.wordpress.org/trunk@23634 1a063a9b-81f0-0310-95a4-ce76da25c4cd