Escape HTML tokens

The demos were wide open to HTML injection - I added a simple HTML escape function.

`repeat()` and `value()` now escapes HTML by default, but you can turn this off by passing false as the (optional) `encode` argument for both functions.

The `encode` argument can also be a function, in case somebody needs to encoding certain strings in a different way, for example if escaping URL tokens.