Removed placeholder, now using escaping instead

It would be bad idea to override render() method in case we need to escape something

Also pushed some other fixes (including security fix) to this branch