escaping inline JS arguments

It's currently pretty easy to break the deployment UI by including the wrong characters in a commit comment (also an unlikely-to-be-exploited security hole); escaping the associated inline JS arguments should fix this.