Add missing escaping

Adds a variety of escaping improvements (mostly to translations) to harden the theme against XSS, XSRF, and other badness.
Cool - though the function hasn't been removed from _s, so we need to leave this patch in the meantime.