Escape JSON when it is output inside <script> tags

Addresses #658