:include_blank and :prompt options for #select not HTML safe

String options :include_blank and :prompt options are not HTML-escaped or checked for safety before being concatenated with markup.

select("post", "person_id", Person.all.collect {|p| [ p.name, p.id ] }, {:include_blank => '<None>'})

produces:

<select name="post[person_id]">
     <option value=""><None></option>
     <option value="1">David</option>
     <option value="2" selected="selected">Sam</option>
     <option value="3">Tobias</option>
</select>

It should produce:

<select name="post[person_id]">
     <option value="">&lt;None&gt;</option>
     <option value="1">David</option>
     <option value="2" selected="selected">Sam</option>
     <option value="3">Tobias</option>
</select>