browser, composer: escape target/queryString template variables

See PR #457 for details (esp. comment https://github.com/graphite-project/graphite-web/pull/457#issuecomment-58926028)
Merge pull request #1003 from deniszh/0.9.x_xss

browser, composer: escape target/queryString template variables