fixes #5471 html escape auto-completer values (CVE-2014-0208)

(cherry picked from commit ee672544f1ad5990ca0e39acd86f83cbbe06ebe9)
Release 1.4.4