Escaping in taxonomy autocomplete

taxonomy_autocomplete() uses filter_xss() on the display string, while user_autocomplete() and profile_admin_settings_autocomplete() use check_plain().

Taxonomy terms are plain-text strings that don't allow rich-text formatting, so they should also be passed through check_plain(). Otherwise strange things occur if you have terms containing special characters. The attached image shows the taxonomy term list (1.), and the taxonomy selector on the node edit page during (2.) and after (3.) auto-completion. Note that the suggested items in 2. don't reflect the actual term names.