Escape all database content by default

This should make it hard to introduce an XSS vulnerability.

For example, before, if you had been able to get a malicious HTML or JS value into one of the database fields we render, it would have been rendered by the browser as HTML/JS, and provided an attack vector.

Escaping by default is the same behaviour as Rails >3, although the implementation differs.