Reduce Vulnerability to XSS

Although fixing XSS completely is [quite difficult](http://www.coverity.com/srl/a-guide-to-fixing-xss-for-devs.html), this simple fix should at least fix the super obvious and useful case when you are using your model's properties to fill the contents of HTML elements or as attributes.

If you were to do, say, `<a href="{some_user_defined_property}"></a>`, this won't escape `javascript:` links there, but in that case escaping the data is likely to just cause more frustration than it solves (chances are, if you're going this route, you might be generating those yourself, and escaping in this case would just be a massive pain).

This *will* catch something like `<a href="/users/{user.id}">{user.name}</a>`, which is the 99% case.