fix some missed HTML escapes, fixes #413