Fix XSS in admin header

The `firstof` template tag does not html escape its arguments, so when
using it to output something like a user's name, it must be wrapped with
`force_escape`.