HTML escape causes the title to be double-escaped

...once here (see https://docs.djangoproject.com/en/dev/ref/templates/builtins/#escape) and then & chars are escaped again by Vellum when rendering the form XML. `escapejs` avoids that because it uses a different type of escaping.

http://manage.dimagi.com/default.asp?112308