Fix XSS a different way

This undoes my last PR and does the escaping of search results in filterOptions.

My last fix doesn't work when selleckt doesn't have a search box, because then the
option text is passed into mustache, which will double-escape the already escaped text