Addresses concerns in #110

Moved from the <%= to <%- for our templates to have some escaping built
in.