escape HTML by default; add option to bypass HTML encoding, or pass a custom encoding function, in repeat() and value()