setup.py: Added Jinja2 dependency
config: Set autoescaping off explicitly

Explicit is better than implicit so we choose to escape the
output explicitly if needed.
templates/users: Converted user list to Jinja2