Fix XSS vulnerability in popups

Hello, everyone!

We use this awesome Semantic-UI library at our project konfettin.ru. 
Thanks a lot for your work!

We faced such problem as XSS vulnerability in popups.
For example, we have such element:
```html
<a href="/some/link" title="&lt;script&gt;alert('Hello, world!');&lt;script&gt;">Link</a>
```
If this element is used with Semantic-UI popup module and popup is shown you see alert. The problem is when you get attribute value with `$('selector').attr('title')` it returns decoded HTML and it is not safe to use it without any processing.

I've found in popup docs [here](http://semantic-ui.com/modules/popup.html#/usage) that for exacly HTML output in popup `data-html` property should be used otherwise any developer expects to see safe encoded text.