Escape usage of `$current_url`

To prevent XSS, use of `$current_url` needs to be properly escaped
One more URL that needs to be escaped
And one more URL to escape
Two more places for escaping
Merge pull request #186 from danielbachhuber/esc-current-url

Escape usage of `$current_url`