fixes #1384 prevent xss attack in app title, also did a first pass of wh...

...ere we can use textContent in place of innerHTML