escape html in markdown templatetag

this prevents XSS - I borked it