Escape entitites for the discount message

We're appending XHTML right below, but not escaping the message text above.