Properly escape some URL template tags.  This concludes the first coding standards pass on the new theme engine.