Rendering level character escaping

This commit replaces all `<%=` with `<%-` to escape user input.

This isn't as secure as I actually feel comfortable with, but I think it's a good start. If we cared enough, for defense in depth, we would probably take measures to sanitize on writes and in the database also (but then we'd have to offer different API output for the android app). Anyway, from now on, don't use `<%=`. Instead use `<%-`.

@omjolie 
@abboudm