Add escaping in a bunch of places

This does not solve everything, but it's a big step. Improving on this
will probably require fixing the confirm dialog.

Longer term steps:
 - Don't substitute values into JS. Move JS out of templates to help
   this not happen accidentally.
 - Move to a templating language that automatically does context-aware
   escaping. Because it's not the 1990s.