Fix extra-encoding in edit form

resolves #260 and theodi/shared#211.

Couldn't replicate in tests, as it's all javascript and browser-side. Fix is to stop the HTML-encoding of the values, but this makes it unsafe, so I've added a strip_tags call as well to prevent injection of malicious user data.