HTML-escape fields passed to revision table in Mako.
Fix download link in freshly uploaded files.

Thanks @caneruguz for catching this.
Merge branch 'hotfix/0.21.24'