browser, composer: escape target/queryString template variables

See PR #457 for details (esp. comment https://github.com/graphite-project/graphite-web/pull/457#issuecomment-58926028)