fix(password recovery) Escape HTML from input fields

This is a work-around to avoid javascript injection. The better way
 would be for msg_dialog to escape error text but that would cause
 problem elsewhere, so in the mean time we escape here.

issue #5918