Security fix: HTML-encode translation parameters
Fixed an XSS vuln in backend

Content type names are strings, not HTML, and should never be output
unencoded.