ensured non-strings are properly converted
added html encoder to template environments
escaped output to html where necessary;

replace `\{\{= ?(.*?) ?\}\}` with `{{= html($1) }}`