Update boilerplates/default/templates/_header.mustache

Default hrefs should be escaped.
Otherwise you end up with crazy shit in href=
Merge pull request #61 from vvo/patch-1

Update boilerplates/default/templates/_header.mustache