Do auto-escaping in Jinja to prevent XSS

As far as I understand auto-escaping does not have any negative effects
other than slowing down Jinja2 a bit, so I haven't tested much other
than confirmed XSS no longer works.

Fixes #348.