Strong anti-XSS protection for underscore.js templates