Security, UI: minor fixes to history, dataset, and page escaping; escape js tag and annotation displays
merge