consent: Fix cross-site scripting.

Two possibilities:
- Users attributes from an untrusted source.
- Metadata from an untrusted source.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2433 44740490-163a-0410-bde0-09ae8108e29a