UP-4235 marketplace add to tab

https://issues.jasig.org/browse/UP-4235
I finished testing, and it is correctly escaping HTML chars as best I can tell.   I think it's OK.