do not sanitize bufferlines

Actually, text like "<foo>" aren't rendered, because ng-bind-html
sanitizes the text. Just use ng-bind instead.