Add missing escaping

Adds a variety of escaping improvements (mostly to translations) to harden the theme against XSS, XSRF, and other badness.
Same question. Not sure adding `_html` is necessary? Just curious...