escape JSON documents to avoid rendering HTML (and possible XSS)