adding check_plain() to escape user-entered text

In the form that is presented to the user who is registering, the title of the fieldset and the text beside the checkbox are not escaped. I discovered this by validating my registration page, and the only error was that an ampersand wasn't encoded. I had set the fieldset title to be "Terms & Conditions". To correct this, I have added the check_plain() function around these two outputs. Please review the attached patch. Thank you!