Use builder to generate the HTML, add xss specs

Closes #1