#938536 by David_Rothstein: Fixed User account tokens in _user_mail_text() should not be sanitized.

modules/user/user.module

@@ -2649,7 +2649,9 @@ Your account on [site:name] has been canceled.
   }
 
   if ($replace) {
-    return token_replace($text, $variables, array('language' => $language, 'callback' => 'user_mail_tokens'));
+    // We do not sanitize the token replacement, since the output of this
+    // replacement is intended for an e-mail message, not a web browser.
+    return token_replace($text, $variables, array('language' => $language, 'callback' => 'user_mail_tokens', 'sanitize' => FALSE));
   }
 
   return $text;