adding escaping to string values

This commit adds HTML escaping to values within json objects since
we use them directly for rendering from the template into javascript
objects. If that isn't the main use, it might be better splitting
that functionality into a second tag.