Security issue

Eco's default `__escape` implementation doesn't escape single quotes, which makes XSS attacks like the following possible:

```html
<input type='text' value='<%= @value %>'>
```

with a @value of `x'onmouseover='alert(document.domain)`, an XSS occurs.

This fork fixes the issue by using Underscore's escape.