working HTML escaping :)

I fixed up the HTML escaping @bitemyapp added

The escaping will now happen by default unless `:escape false` is passed in to `render` and `render-file` as the last argument.

`to-json` will always set escaping to `false` so that json doesn't get mangled, added tests for all cases and updated docs, hopefully this is acceptable.