browser, composer: escape target/queryString template variables

This fixes:

* XSS

    e.g. `?target="/><script>...</script><!--`

* Targets with special characters, like double quotes

    e.g. `?target=summarize(foo.bar,"1hr")`