Escape <, > and & in HTML

Also adds `<html>` and other boilerplate tags.

I've not included an updated `index.html`.