Use <%- when interpolating XSS targets

  - I tried to not be super heavy handed, only using <%- for values that
    could be set with XSS payloads or otherwise come from a user/data.

Conflicts:
	src/fauxton/app/addons/auth/templates/nav_link_title.html