More $sce for messages

Unfortunately bindonce doesn't work with $sce correctly
https://github.com/Pasvaz/bindonce/issues/78
(and unfortunately we previously encouraged doing exactly the wrong,
thing, because we were misusing $sanitize)
Fix misc api calls: funder and cite lookups