Update boilerplates/default/templates/_header.mustache

Default hrefs should be escaped.
Otherwise you end up with crazy shit in href=