pull in my latest change to HAL-Browser

escape JSON to avoid rendering HTML (and possible XSS)