Escape messages (no Jinja autoescape in .js templates)