Use <%- when interpolating XSS targets

See the JIRA: https://issues.apache.org/jira/browse/COUCHDB-2232