first pass better js/attr escaping