Security fixes.

This should fix the stuff in #41.
- Fix arbitrary code evaluation issue that exposed GM_* / chrome API and userscript local filename to scripts running on the page.
- HTML escape post data from the archives rather than trusting the archives to escape it server side (and not do anything malicious).
- Make sure all HTML attributes in the post building code are quoted.