I notice that we're not enabling auto-escape here, which means we need to either (A) escape lots of things in our templates manually (which you don't seem to be doing in your templates) or (B) enable it here *and* make sure we're requiring a version of nunjucks that actually supports it, since it was [added fairly recently](https://github.com/jlongster/nunjucks/pull/32).