escape HTML entities to avoid XSS attacks in DataTables

BTW, per recommendation of http://datatables.net/manual/server-side, the parameter `draw` is coerced to integer
per-column escaping
apply `escape` to column names as well
a news item for #627 [ci skip]
fix the issue reported by Tareef: dplyr tbl_df objects are also data frames, but the default non-standard evaluation df[, j] will fail in dataTablesJSON(), so we need to coerce such objects to data frames explicitly
make `escape` support column names in renderDataTable(), per suggestion of @jcheng5
Merge pull request #627 from yihui/bugfix/DT-XSS

escape HTML entities to avoid XSS attacks in DataTables