webserver: htmlescape VERSION and config name

Those should not really have html characters in them, but let's be sure.
Merge pull request #1656 from zeha/ws-addtl-htmlescape

webserver: htmlescape VERSION and config name