Cross site scripting/HTML code injection vulnerability

Displayed values under `/debug` aren't HTML-escaped. E.g. this opens an alert showing the text "powned":
http://iframely.com/debug?uri=http%3A%2F%2Ffiddle.jshell.net%2FGDkAj%2F1%2Fshow%2F

This commit fixes these issues, but I don't guarantee that there aren't any others. There is a lot of HTML-building in `debug.js` that uses string concatenation, but I *think* the remaining cases don't contain values from the extracted website.