One more HTML escaping piece (#1195).

I don't love the duplication of code between this file and dfxp.js,
but hopefully all the editor stuff is going away soon.