download link theme double-escape, + incorrect comment

in file_entity.theme.inc, theme_file_entity_download_link has the following comment:

// Peform unsanitized token replacement if $uri['options']['html'] is empty
// since then l() will escape the link text.

However the line that follows does the opposite, indicating that this might be a bug.
$variables['text'] = token_replace($variables['text'], array('file' => $file), array('clear' => TRUE, 'sanitize' => empty($uri['options']['html'])));

We find that because the $uri['options']['html'] appears to be always empty, sanitize is in fact true. This is causing the resulting [file:name] value to be double-escaped.

Steps to reproduce: in a file media entry, create a new file download that has an apostrophe in the name.