Use cgi.escape instead of markupsafe.escape

We don't declare a dependency to markupsafe, so we shouldn't use it, especially when cgi.escape is in the stdlib.