Security fixes.

Fix arbitrary code evaluation issue that exposed GM_* / chrome API
and userscript local filename to scripts running on the page.

HTML escape post data from the archives rather than trusting the
archives to escape it server side (and not do anything malicious).

Make sure all HTML attributes in the post building code are quoted.