add ESAPI encodeForHTMLAttribute on form actions