[1.6.x] Fixed #4991 -- Emphasized XSS ramifications of help_text not being escaped.

Backport of 5dbe2a9431 from master