Escape entitites for the discount message

We're appending XHTML right below, but not escaping the message text above.

PT Story: https://www.pivotaltracker.com/story/show/82953862