Added auto escape HTML via erubis …
Changed Gemfile and config/environment.rb