login/commits: escape html characters in commit messages