ok, I never fully understood why the whole escaping of the serialized token. But now that we rely on `express-state`, I will argue that `express-state` is responsible for any escaping process needed to expose data into the client side as part of the html response. /cc @ericf