Server side HTML escaping in params rendering

Replacement of client side HTML escaping by server side HTML escaping - causes less trouble.

Previous solution caused JS error when a nested JSON object has been passed using `js :params => {...}` in controller.