HTML-escape album names to avoid XSS

If a user has an album named `<script>alert(1)</script>` the JavaScript will get executed. If they have one named `</div></div></div>` the layout will get messed up.

While this can only be done to yourself, so probably doesnt represent any security threat, it's still messy and so should always be escaped before display.