HTML escaping in template