XSS fix: unescaped var interpolation in login form

There was unescaped variable interpolation in the login form, which
could potentially cause an XSS exploit. This is now fixed. This form is
a bit ancient and wasn't checked with the 'internal' JSPs when I checked
for these types of problems last year.
XSS: Further risky unescaped outputs in JSP

Following from the last commit, an audit of the other JSP files revealed
a few other potential risky unescaped outputs in JSP. These a fixed in
this commit.
Further minor defensive JSP improvements

Following from the previous 2 XSS fixes, this commit adds further
defensive output escaping to JSPs for values which do not _need_
escaping (such as enum constants, internally generated values, numbers).
Updated release notes for 1.0.0-beta7 release