Fix html and js injection

Introducing Mustache for templating.

- [ ] Merge #2 before this one