HTML-escape album names to avoid XSS