Hi,
Why don't you use a LM7805, and forget about the resistors, just use the appropriate bypass caps.
The tag of the LM7805 is gnd, so you won't need to insulate the tag from the heatsink.
Tom....
If you use the circuit you have posted, how will you know if the 317 has failed, the zener will just clamp the output.
Use a 1W zener and put a 250mA fuse in place of the 100R resistor, now if 317 fails and output goes to 16V, for an instant more than 250mA flows and blows the fuse, output goes to zero, device is saved.