Bugfix/prevent html injects in statements

Prompted by #722 and then noticing the revert necessary for #723, I simply audited the instances of displaying the statement on the site and found two minor vulnerabilities. They are not server vulnerabilities. That is, they do not directly reveal any personal information or game the site in any way. However, they can override the style, act maliciously, and even inject javascript to fool the user.

**index.html**: meta og:description: **was not escaped**

I confirmed in a development environment that I can indeed close the tag and inject a `<link>` or `<meta>` etc in `<head>`, which is obvi-bad) For instance, a test string would be

```
"/><meta name="my_new_meta" content="my own thing
```

or 
```
"/><link href="http://somewhere/slow.css" rel="stylesheet" type="text/css" /><meta name="foo" content="
```

Obviously, injecting javascript via `<link>` would be terrible too.

**about/goals.html**: **statement not escaped**

This is one of the data dumps available for one to view. It's kinda broken in other ways (I corrected a small typo as well), but it is indeed accessible from the site. It displays a list of users and their statements, unescaped. I simply escaped it.

No data audit is *necessary* (but perhaps still valid in case somebody was already malicious and injecting code) since the field is stored raw and these changes will not allow arbitrary html to be injected.

fyi: I totally cannot run the tests. They fail on master, which I forked from. fail at tests/test_pages.py:25 (test_profile)