Merge branch 'hotfix/add-bugzilla-mholec'
Escape double quote characters in user supplied values
Also replace backslash (\) and ampersand(&) which can be used to break
out of the string
Do not escape csrf_token or id as those are not user-supplied
Remove "replace" that was mistakenly left when removing escaping of id
Fix the genshi vs python problem by marking the script as CDATA
One last try -- use Markup.escape() so genshi does not escape the
escaped user provided data.
Third time isn't always the charm but the last time always is.
Merge branch 'hotfix/escape-quotes' into develop