escape html unless asked not to
properties and includes working