webserver: htmlescape VERSION and config name

Those should not really have html characters in them, but let's be sure.