Allowed HTML-escaping of data bindings