not a fan of turning autoescape off