will escape html
using server side session instead of class variables.
for sure storing whole connection in the session is not the best idea but if you use class variables anyone can open /collection/:collection after the first user connects to mongo :)
Merge pull request #1 from Shoen/master

Two changes