This seems somewhat serious. The default configuration makes it incredible easy to have an XSS vulnerability. Is there a good way to ensure that data is escaped by default?