always display current record type in drop down list, even if not in the list of supported types. some more htmlspecialchars and SPF/... sanitizing fixes too