Fix XSS vulnerability for html files served up with "Content-Disposition attachment" headers

This is a slightly more complete fix for the XSS issues identified in #195 that covers the case where untrusted user-uploaded html files are served up with one of the correct html Content-types and "Content-Disposition: attachment" headers (https://github.com/rails/turbolinks/issues/195#issuecomment-52037314). Test case included.
You can move this up above the `<li><h5>`. These are all "airplane/offline mode" tests.