HTML escape causes the title to be double-escaped

...once here (see https://docs.djangoproject.com/en/dev/ref/templates/builtins/#escape) and then & chars are escaped again by Vellum when rendering the form XML. escapejs avoids that because it uses a different type of escaping.
Merge pull request #3361 from dimagi/112308-double-escape

HTML escape causes the title to be double-escaped