Fix how figure id is passed to browser to support Tornado 3.2
Merge pull request #2849 from mdboom/webagg/tornado-escape-fix

WebAgg issue - Uncaught SyntaxError: Unexpected token &