Fauxton: Configurable escaping of notifications

Sometimes we are passing static html-links to the notification-
helper. With the new setting `escape: false` the escaping for
the notifications can be disabled.

The default value is that all values are escaped, as long as
no value with `false` is passed for the option escape.
`undefined` and other falsy values will not unescape.

I updated all occurences where we are passing html to the
notifications, and added a comment, that people are careful, when
the passed message changes to e.g. a dynamic content generated
from users.