Fixed HTML escaping of filename in website

Previously if you uploaded a file such as "<b> file.pdf", it would not
escape the HTML.