Additional HTML escape for single quotes and slash

OWASP recommendations:
 & --> &amp;
 < --> &lt;
 > --> &gt;
 " --> &quot;
 ' --> &#x27;
 / --> &#x2F;
HTML escape function moved *inside* text highlight function
Removed all occurrences of double escapes (highlight+escape)
Added encoding for tab labels
Merge pull request #3 from certego/xss

XSS in elsa web