security: escape script tags in _json_

This fixes a possible exploit that occurs when user-entered data is embedded via `_json_` and contains the string `</script>`, which could allow arbitrary html after that to be injected into the page.

The fix has the caveat that the resulting JSON isn't quite valid, because of the string concatenation, but still works when using it as straight js, such as `var conf = {{{conf}}}`