make plain text editor a bit safer by enforcing escaping at render time