Tokens used in default_value are escaped

Problem/Motivation

We have a site with a "name" field that often contains multiple names with an ampersand -- for example, "Doe, John & Mary". When using the [current_user:field_name] token, the ampersand gets HTML-encoded to &.

Steps to reproduce

Create a user field.

Put an & in it.

Use the token for the field as the default value of a webform field.

Go to the form and see "Doe, John & Mary" in the form element.

Proposed resolution

Un-escape the values when used as a default field.

Remaining tasks

Write patch.