Prevent XSS by escaping potential HTML

Escapes potential HTML content by adding a `h` helper method and using it in the views whenever text output from the DB is rendered into a view.

Closes #49