Properly escape CourseKeys and UsageKeys in html templates

hmm.. is there no test to catch this?