use html/template to correctly escape values given by a user