Another XSS leak fixed.
Fixed: was html-encoding the wrong argument.

I, too, need more coffee.
Fixed: XSS in content edit title