Add checked(), selected() to auto-escaped funcs

These functions aren't potential XSS vectors since the strings that they output are hardcoded.