Escape $acf['title'] when adding meta box

closes xss injection vector in post edit screen
Ensure fields copied in JS are xss injection proof

leverage createTextNode in two more places to ensure safe js copies